CVE-2026-101022: CWE-918 in Grid Protection Alliance openPDC

The vulnerability arises from a Modbus connection feature in openPDC that accepts a caller-specified destination address and port without restricting which internal hosts may be targeted. An authenticated user can leverage this to attempt connections to arbitrary internal network destinations, revealing reachability information. Repeated connection attempts can allow an attacker to map the internal network topology. This issue is tracked as CWE-918 (Server-Side Request Forgery).

An authenticated attacker can use this vulnerability to perform internal network reconnaissance by discovering which internal hosts are reachable through the openPDC Modbus connection feature. This information disclosure can aid in further attacks but does not directly impact confidentiality, integrity, or availability beyond the limited information exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict access to the openPDC Modbus connection feature to trusted authenticated users only and consider network segmentation to limit internal host exposure.