On 8 October 2026, CISA published ICSA-26-281-02 for Grid Protection Alliance openPDC and openHistorian, software used in the energy sector for phasor and time series data. CISA states that no known public exploitation specifically targeting these vulnerabilities has been reported to it. The researcher credited is Shubham Raj of Causal Security.
What's affected
openPDC before 2.9.482 and openHistorian before 2.8.585 are affected, with some CVEs fixed earlier at 2.9.477 and 2.8.580. The openPDC Docker image is affected and no fix is planned. GPA does not recommend production use of its published Docker images.
| CVE | Weakness | CVSS 3.1 |
|---|---|---|
| CVE-2026-100730 | CWE-502 deserialization of untrusted data | 9.8 |
| CVE-2026-105278 | Hard-coded credentials in the Docker image | 9.8 |
| CVE-2026-104629 | Unsafe reflection | 8.8 |
| CVE-2026-105281 | Missing authentication on the data publisher | 7.5 |
| CVE-2026-85479 | Missing authentication on the STTP publisher | 5.3 |
| CVE-2026-101022 | Server-side request forgery in Modbus connections | 4.3 |
The deserialization flaw can be reached without authentication on systems that do not use Windows Authentication. The default bindings were changed to loopback only for new installations. Upgraded systems keep old settings, so check them by hand.
What to do now
- Upgrade openPDC to 2.9.482 or later and openHistorian to 2.8.585 or later.
- Check which interfaces the data publishers listen on, and bind them to loopback unless remote access is required.
- Turn on Windows Authentication for the service console.
- Do not run the published Docker images in production. If you already do, change the administrative credential and restrict the management interface.
- Restrict Modbus destinations at the firewall and block loopback and RFC 1918 targets unless needed.
- Keep these systems off the internet and behind firewalls, as CISA advises.
How this could have been avoided
- Authentication by default. Two of the six flaws are publishers that accept unauthenticated connections out of the box.
- No fixed credentials in images. A forced password change at first start closes the Docker issue.
- Safe config on upgrade. Applying the new loopback default to existing installs would protect upgraded systems.
Quick check
Why are upgraded openPDC systems possibly still exposed?
The loopback default applies only to new installations, so upgraded systems keep their previous listening settings until an operator changes them.
