Grid Protection Alliance openPDC: Missing authentication in internal data publisher

Summary

The internal data publisher of openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker who can reach the interface can retrieve the complete device and measurement topology of the system. The issue affects confidentiality only; no code execution or write access is described.

Affected

• openPDC below 2.9.482 (CISA also lists ranges below 2.9.477)
• openPDC Docker image below 2.9.482
• openHistorian below 2.8.585 (CISA also lists ranges below 2.8.580)

Fixed in

• openPDC 2.9.482 or later
• openHistorian 2.8.585 or later
• openPDC Docker image: no fix planned
• The new default binding applies only to new installations; upgraded installations keep their previous configuration.

Workaround

• Verify the configuration explicitly and bind the publisher interface to the local loopback address only.
• Block access to the interface with firewalls and network segmentation.
• Docker deployments: no vendor fix is available; the vendor does not recommend production use of the Docker image.

Exploitation

• CISA reported no known public exploitation of these vulnerabilities at publication.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof of concept found; not listed in CISA KEV according to one aggregator.

Our recommendation

• Check whether openPDC or openHistorian is in use, including Docker deployments.
• Upgrade to openPDC 2.9.482 or later and openHistorian 2.8.585 or later.
• After upgrading, verify the interface binding, because upgraded installations keep the old configuration.
• Restrict network access to the publisher interface and keep control system networks separated from business networks.
• Replace or isolate Docker deployments, since no fix is planned for the image.
• Patch all items in CISA ICSA-26-281-02 together, especially the critical deserialization issue CVE-2026-100730.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CISA ICSA-26-281-02 www.cisa.gov
• CISA CSAF file ICSA-26-281-02 github.com
• Vulners CVE-2026-105281 vulners.com
• PSIRT CVE-2026-105281 psirt.com
• Strix CVE-2026-105281 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:10.