CVE-2026-101022: Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)

Medium severity · published Oct 9, 2026

CVE-2026-101022

Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)

4.3

CVSS

0.2%

EPSS

On KEV

Description

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 8% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

openHistorian · Grid Protection Alliance

before 2.8.580; before 2.8.585 · source: vendor

openPDC · Grid Protection Alliance

before 2.9.477; before 2.9.482 · source: vendor

openPDC (Docker image) · Grid Protection Alliance

before 2.9.477; before 2.9.482 · source: vendor

In the news

VulnerabilityCritical

Grid Protection Alliance openPDC and openHistorian

View CSAF Summary The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) openPDC (Docker image) <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022, CVE-2026-105278) openHistorian <2.8.580, <2.8.585 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) CVSS Vendor Equipment v3 9.8 Grid Protection Alliance openPDC 5 Vulnerabilities Deserialization of Untrusted Data, Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), Use of Hard-coded Credentials, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-100730 A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which coul...

CVE-2026-104629 CVE-2026-100730 CVE-2026-105281

Oct 8, 2026·CISA Advisories

Affected product

openHistorian

Grid Protection Alliance

All openHistorian CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-101022

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-101022

www.cisa.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02

github.com

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json