CVE-2026-105281

HIGH 7.5

Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.

CWE	CWE-306
Vendor	grid protection alliance
Product	openpdc
Published	Oct 9, 2026

Stay Ahead of the Next One

Get instant alerts for grid protection alliance openpdc

Be the first to know when new high vulnerabilities affecting grid protection alliance openpdc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Grid Protection Alliance / openPDC

0 < 2.9.477 0 < 2.9.482

Grid Protection Alliance / openPDC (Docker image)

0 < 2.9.477 0 < 2.9.482

Grid Protection Alliance / openHistorian

0 < 2.8.580 0 < 2.8.585

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json

Credits

Shubham Raj (Cipher) of Causal Security reported this vulnerability to CISA.