CVE-2026-105278

Summary

The openPDC Docker image contains a hardcoded administrative credential that never expires, allowing attackers with network access to immediately gain full administrative control of the application. This hard-coded credential creates a persistent backdoor that can be exploited without any user interaction or additional authentication steps.

Exploitability

Extremely easy to exploit with no prerequisites - an attacker only needs network access to the management interface to authenticate using the fixed credential and gain complete administrative privileges.

Blast radius

The impact is significant as this vulnerability affects all deployments using the vulnerable Docker image, potentially exposing critical infrastructure management interfaces to unauthorized administrative access.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to openPDC version 2.590 or later which includes a fix for the hardcoded credential issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.