CVE-2026-105281: Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

High severity · published Oct 9, 2026

CVE-2026-105281

Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

7.5

CVSS

0.3%

EPSS

On KEV

Description

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 24% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

openHistorian · Grid Protection Alliance

before 2.8.580; before 2.8.585 · source: vendor

openPDC · Grid Protection Alliance

before 2.9.477; before 2.9.482 · source: vendor

openPDC (Docker image) · Grid Protection Alliance

before 2.9.477; before 2.9.482 · source: vendor

In the news

VulnerabilityCritical

Grid Protection Alliance openPDC and openHistorian

View CSAF Summary The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) openPDC (Docker image) <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022, CVE-2026-105278) openHistorian <2.8.580, <2.8.585 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) CVSS Vendor Equipment v3 9.8 Grid Protection Alliance openPDC 5 Vulnerabilities Deserialization of Untrusted Data, Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), Use of Hard-coded Credentials, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-100730 A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which coul...

CVE-2026-104629 CVE-2026-100730 CVE-2026-105281

Oct 8, 2026·CISA Advisories

Affected product

openHistorian

Grid Protection Alliance

All openHistorian CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-105281

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-105281

www.cisa.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02

github.com

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json