Unauthenticated Network Access Vulnerability in openPDC by Grid Smarter Cities
CVE-2026-105281

8.7HIGH

Key Information:

Vendor

Grid Protection Alliance

Status
Openpdc
Openpdc (docker Image)
Openhistorian
Vendor
CVE Published:
9 October 2026

What is CVE-2026-105281?

The openPDC data publisher is susceptible to unauthorized network connections due to its default configuration, allowing attackers to access critical device and measurement topology information without authentication. This vulnerability exposes sensitive system data, potentially leading to further exploitation if left unaddressed. Organizations using openPDC should take immediate steps to secure their configurations to prevent unauthorized access.

Affected Version(s)

openHistorian 0 < 2.8.580

openHistorian 0 < 2.8.585

openPDC 0 < 2.9.477

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shubham Raj (Cipher) of Causal Security reported this vulnerability to CISA.
.