CVE-2026-105278

The official Docker image for Grid Protection Alliance's openPDC, an open-source phasor data concentrator used in electric grid synchrophasor networks, ships with a fixed default administrative credential that is never forced to change on first login. An attacker who can reach the management interface over the network can simply authenticate with this well-known credential, requiring no privileges or user interaction. Successful authentication grants full administrative control of the application, compromising the confidentiality, integrity, and availability of the collected grid measurement data (CVSS 4.0: 9.3, critical). The ICS advisory also names GPA's openHistorian, though the fixed credential is explicitly confirmed for the openPDC Docker distribution. There is no known public proof of concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

What to do: Immediately change the administrative credential in any openPDC instance deployed from the published Docker image and verify no unexplained logins or config changes have occurred. Restrict the management interface to trusted internal networks or VPN access — it should never be internet-exposed — and monitor it for authentication attempts. Track the GPA/ICS-CERT advisory for patched images and redeploy from an updated build when available, and review any sibling openHistorian installations for the same default-credential pattern.