Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-85479 EUVD-2026-95781GHSA-xr5w-f3rm-m5gq

Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

Published Oct 9, 2026 · Updated Oct 11, 2026 · Assigned by icscert

Vendor: Grid Protection Alliance Product: openHistorian Product: openPDC Product: openPDC (Docker image)

Description

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.

Affected products

VendorProductAffectedFixed
Grid Protection Alliance openPDC < 2.9.477, < 2.9.482 2.9.477
Grid Protection Alliance openPDC (Docker image) < 2.9.477, < 2.9.482 2.9.477
Grid Protection Alliance openHistorian < 2.8.580, < 2.8.585 2.8.580

Advisories 1

References