As cited
Copy frozen at (site build).
vulnerabilities
Grid Protection Alliance openPDC and openHistorian
Grid Protection Alliance released security updates for openPDC and openHistorian addressing five critical vulnerabilities. The flaws include unsafe deserialization that enables remote code execution (RCE), missing authentication on data publisher interfaces, a Modbus connection allowing network reconnaissance, hardcoded credentials in Docker images, and unsafe component loading. Patches are available in openPDC 2.9.482 and openHistorian 2.8.585, though Docker images have not been updated and Grid Protection Alliance does not recommend their production use.
Why it matters: Energy sector operators running openPDC or openHistorian must upgrade immediately or verify configuration changes, as CVE-2026-100730 and CVE-2026-105278 allow unauthenticated RCE with a CVSS score of 9.8 and 9.3 respectively; existing deployments will not receive default binding changes for authentication-less interfaces automatically.
- Source published
- First seen by Cybersecurity Tracker