Skip to content
OpenAdvisories
High · 7.5 CVE-2026-105281 EUVD-2026-95780GHSA-cg72-3fmm-q6mm

Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

Published Oct 9, 2026 · Updated Oct 11, 2026 · Assigned by icscert

Vendor: Grid Protection Alliance Product: openHistorian Product: openPDC Product: openPDC (Docker image)

Description

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.

Affected products

VendorProductAffectedFixed
Grid Protection Alliance openPDC < 2.9.477, < 2.9.482 2.9.477
Grid Protection Alliance openPDC (Docker image) < 2.9.477, < 2.9.482 2.9.477
Grid Protection Alliance openHistorian < 2.8.580, < 2.8.585 2.8.580

Advisories 1

References