CVE-2026-105278

{
  "etk_id": "ETK-2026-1084",
  "cve_id": "CVE-2026-105278",
  "display_id": "CVE-2026-105278",
  "ghsa_id": "GHSA-99g4-gvqf-7f8p",
  "euvd_id": "EUVD-2026-95790",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Fixed administrator credential in openPDC Docker image",
  "summary": "Published openPDC Docker images include an administrative credential that is not required to change on initial use. An attacker who can reach the management interface may authenticate with that credential and obtain administrative control.",
  "mitigation": "Restrict management-interface access to trusted administrators and non-public networks immediately. Change the administrative credential where supported, and replace the image with a vendor-corrected release when one is identified.",
  "vendor": "Grid Protection Alliance",
  "product": "openPDC (Docker image)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.9.477",
        ">= 0, < 2.9.482"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.9.477",
        "2.9.482"
      ],
      "package_name": "openPDC (Docker image)",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0034,
  "epss_percentile": 0.2628,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.384982333333333,
  "t0_at": "2026-10-09T14:01:21.533000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T14:01:21.533000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T14:01:21.533000+00:00",
      "url": "https://github.com/advisories/GHSA-99g4-gvqf-7f8p"
    }
  }
}