Threat Intelligence Database

The Grid Protection Alliance openPDC Docker image contains a critical vulnerability where a fixed administrative credential is included without requiring a forced change on first use. This allows an attacker with network access to the management interface to authenticate using the default credential and gain full administrative control of the application.

CVE-2026-104629 is a high-severity vulnerability in Grid Protection Alliance's openPDC and openHistorian products. The vulnerability arises from a component loading mechanism that can instantiate and execute any specified type, including invalid components. An authenticated attacker who can place a file on the host filesystem may exploit this to execute arbitrary constructor code with the privileges of the affected service account.

CVE-2026-101022 is a vulnerability in the Grid Protection Alliance openPDC product where a Modbus connection feature allows an authenticated user to specify arbitrary internal network destinations without restriction. This can enable the user to discover which internal hosts are reachable, potentially mapping the internal network. The vulnerability has a medium severity with a CVSS score of 4.3.

CVE-2026-85479 is a medium severity vulnerability in the Grid Protection Alliance openPDC product. The STTP-based data publisher component accepts network connections without requiring authentication by default. This allows an unauthenticated attacker on the network to connect and exchange data with the interface. The vulnerability affects multiple versions prior to 2.9.477, 2.9.482, 2.8.580, and 2.8.585. There is no indication of a patch or fix available at this time.

CVE-2026-105281 is a vulnerability in the Grid Protection Alliance openPDC product where the internal data publisher accepts network connections without authentication by default. This allows an unauthenticated attacker to connect and retrieve the full device and measurement topology of the system. The vulnerability affects multiple versions prior to 2.9.477, 2.9.482, 2.8.580, and 2.8.585. It has a high severity with a CVSS score of 7.5.

CVE-2026-100730 is a critical deserialization vulnerability in the Grid Protection Alliance openPDC and openHistorian products. It involves a service console interface that deserializes client-supplied data. On systems without Windows Authentication, this interface is accessible to unauthenticated network attackers, while on systems with Windows Authentication, attackers must already be authenticated. Successful exploitation could allow remote code execution with the privileges of the affected service account.