Critical Flaw in openPDC Docker Images Exposes Hardcoded Admin Credentials

The Grid Protection Alliance has identified a critical security vulnerability in its openPDC software, specifically within the published Docker images. The flaw, designated CVE-2026-105278, allows remote attackers to gain full administrative control of the application by using hardcoded credentials that do not require a password change upon first use.

The vulnerability carries a CVSS base score of 9.8, classifying it as Critical. According to the National Vulnerability Database (NVD) record, the issue falls under CWE-798, which pertains to the use of hard-coded credentials. An attacker with network access to the management interface can authenticate using these fixed credentials. Once authenticated, the attacker obtains full administrative control over the openPDC application, potentially compromising the integrity and confidentiality of the energy data management system.

Context and Background

The openPDC (Open Platform for Data Collection) is a software platform designed for collecting, storing, and analyzing power system data. It is widely used in the electric power industry for situational awareness and monitoring. The vulnerability exists in the default configuration of the Docker images provided by the vendor. By embedding fixed administrative credentials directly into the image without enforcing a credential change on initial deployment, the software creates a predictable entry point for unauthorized users. This type of misconfiguration is particularly dangerous in containerized environments where images are often deployed automatically without manual security review.

Who Is Affected

The vulnerability affects users of the Grid Protection Alliance openPDC Docker images. Specifically, versions prior to 2.9.477 and versions prior to 2.9.482 are impacted. Organizations that have deployed these specific versions of the Docker image in their environments are exposed to remote exploitation. Any system running these affected versions where the management interface is accessible to an attacker is at risk. The flaw does not affect the standard installation packages or versions newer than the specified cutoffs, provided they are not using the vulnerable Docker artifacts.

What should you do?

Security professionals should immediately audit their infrastructure for instances of openPDC Docker images. If affected versions are in use, organizations should prioritize upgrading to the patched versions (2.9.477 or 2.9.482 and later) as soon as they are available. Until an update is applied, administrators should restrict network access to the openPDC management interface. Implementing strict firewall rules to limit access to trusted IP addresses can mitigate the risk of remote exploitation. Additionally, monitoring logs for unauthorized login attempts using the known default credentials can help detect active exploitation.