{"id":"CVE-2026-105278","published":"2026-10-09T15:17:08.197","lastModified":"2026-10-11T17:17:01.573","description":"The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-798"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json","tags":[]}],"hasPoc":true,"ai":{"summary":"The openPDC Docker image contains a hardcoded administrative credential that never expires, allowing attackers with network access to immediately gain full administrative control of the application. This hard-coded credential creates a persistent backdoor that can be exploited without any user interaction or additional authentication steps.","exploitability":"Extremely easy to exploit with no prerequisites - an attacker only needs network access to the management interface to authenticate using the fixed credential and gain complete administrative privileges.","blast_radius":"The impact is significant as this vulnerability affects all deployments using the vulnerable Docker image, potentially exposing critical infrastructure management interfaces to unauthorized administrative access.","remediation":"Upgrade to openPDC version 2.590 or later which includes a fix for the hardcoded credential issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","auth-bypass","admin-access"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:43:36.391Z"}}