CVE-2026-105278: falha crítica em Grid Protection Alliance openPDC (Docker image)
Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.3%
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Grid Protection Alliance · openPDC (Docker image)CVEs relacionadas — Grid Protection Alliance openPDC (Docker image)
No mesmo produto, das mais perigosas para as menos.
CVE-2026-100730CRITICALGrid Protection Alliance openPDC and openHistorian Deserialization of Untrusted DataEPSS 0.6%CVE-2026-104629HIGHGrid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or CodeEPSS 0.3%CVE-2026-105281HIGHGrid Protection Alliance openPDC and openHistorian Missing Authentication for Critical FunctionEPSS 0.3%CVE-2026-85479MEDIUMGrid Protection Alliance openPDC and openHistorian Missing Authentication for Critical FunctionEPSS 0.3%CVE-2026-101022MEDIUMGrid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)EPSS 0.2%