Remote Hackers Bypass openPDC Auth via Hardcoded Admin Keys in Critical CVE-2026-105278
A critical vulnerability in openPDC Docker images allows remote attackers to bypass authentication using hardcoded administrative credentials.
Key points
- CVE-2026-105278 is rated CVSS 9.8 Critical by the National Vulnerability Database
- The flaw affects openPDC Docker images prior to versions 2.9.477 and 2.9.482
- Attackers gain full administrative control without needing to change the default password
Organizations using openPDC Docker images face immediate risk of unauthorized administrative access due to a critical security flaw. The vulnerability, identified as CVE-2026-105278, allows attackers to authenticate using fixed credentials embedded in the software. This issue affects versions before 2.9.477 and before 2.9.482, according to the National Vulnerability Database.
How it unfolded
- The National Vulnerability Database recorded CVE-2026-105278 with a CVSS score of 9.8
- The flaw was identified in the published Docker image for openPDC maintained by the Grid Protection Alliance
- The vulnerability stems from CWE-798, involving use of hardcoded credentials that do not require change
- Attackers with network access to the management interface can exploit this to gain full control
Who is affected
Managed service providers and grid operators relying on openPDC for data collection are directly exposed. The application is used for monitoring power grid performance, making unauthorized access a significant operational risk. Any deployment using the vulnerable Docker images prior to version 2.9.477 or 2.9.482 is susceptible. The flaw exists in the default configuration provided by the publisher.
Our take on the response
The severity rating of 9.8 reflects the ease of exploitation and the high impact of gaining administrative privileges. The National Vulnerability Database classifies this as Critical, indicating immediate attention is required. The lack of a forced password change on first use means the hardcoded credentials remain valid indefinitely. This design error turns a standard administrative interface into an open door for remote attackers.
What to do and how to stay safe: openPDC
- Audit all deployments to identify any instances of openPDC Docker images running versions before 2.9.477 or 2.9.482
- Restrict network access to the openPDC management interface to trusted internal networks only, blocking external exposure
- Monitor authentication logs for login attempts using the known default administrative credentials
- Prepare to apply vendor updates immediately once a patched version is confirmed available for your deployment
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-105278?
It is a critical vulnerability in openPDC Docker images that includes fixed administrative credentials with no forced change on first use.
Which versions of openPDC are affected?
The National Vulnerability Database lists openPDC Docker images before version 2.9.477 and before version 2.9.482 as affected.
How severe is this vulnerability?
The National Vulnerability Database rates CVE-2026-105278 as Critical with a CVSS score of 9.8.
