Advisories › Grid Protection Alliance › ICSA-26-281-02
Grid Protection Alliance openPDC and openHistorian: 6 CVEs, Critical 9.8
Summary
CISA reports 6 vulnerabilities in Grid Protection Alliance openPDC, openPDC (Docker image), openHistorian. Weakness types: Deserialization of Untrusted Data, Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF) (+2 more). Successful exploitation of these vulnerabilities could allow an attacker to gain administrative control of the system, execute arbitrary code, access sensitive operational data, or map the internal network. Highest CVSS v3 score: 9.8 (Critical), exploitable over the network.
What to do: Act now: Grid Protection Alliance has added additional validation into serialization logic in openPDC version 2.9.482 and later and openHistorian version 2.8.585 and later.
At a glance
- Vendor
- Grid Protection Alliance
- Products
- openPDC, openPDC (Docker image), openHistorian
- CVEs
- CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022, CVE-2026-105278, CVE-2026-104629
- Highest CVSS v3
- 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-100730 | Deserialization of Untrusted Data | 9.8 | – | No | A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which c… |
| CVE-2026-105281 | Missing Authentication for Critical Function | 7.5 | – | No | The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system. |
| CVE-2026-85479 | Missing Authentication for Critical Function | 5.3 | – | No | The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it. |
| CVE-2026-101022 | Server-Side Request Forgery (SSRF) | 4.3 | – | No | A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network. |
| CVE-2026-105278 | Use of Hard-coded Credentials | 9.8 | – | No | The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application. |
| CVE-2026-104629 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | 8.8 | – | No | A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account. |
Affected products (6)
- Grid Protection Alliance openPDC <2.9.477
- Grid Protection Alliance openPDC <2.9.482
- Grid Protection Alliance openPDC (Docker image) <2.9.477
- Grid Protection Alliance openPDC (Docker image) <2.9.482
- Grid Protection Alliance openHistorian <2.8.580
- Grid Protection Alliance openHistorian <2.8.585
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Grid Protection Alliance has added additional validation into serialization logic in openPDC version 2.9.482 and later and openHistorian version 2.8.585 and later. Systems using Windows Authentication are additionally protected, as they require the attacker to already be authenticated to reach this function. link
- No Fix Planned: Grid Protection Alliance does not recommend production use of published Docker images in any case. The fix for this vulnerability has not been published to the Docker image.
- Vendor Fix: Grid Protection Alliance updated the default configuration to bind this interface to the local loopback address only. This change applies to new installations; existing installations upgraded from an earlier version retain their prior configuration and will not receive the new default automatically. Operators should verify their configuration explicitly and update the interface binding if it is still set to accept connections on all interfaces.
- Mitigation: Grid Protection Alliance recommends restricting network access to modbus using a firewall, and disallowing connections to loopback and private (RFC 1918) address ranges unless explicitly required.
- Vendor Fix: Grid Protection Alliance has added additional verification and integrity checks of adapters in openPDC version 2.9.477 and later and openHistorian version 2.8.580 and later. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.