openPDC vulnerabilities

3 known vulnerabilities in openPDC from Grid Protection Alliance. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  openPDC: Missing Authentication for Critical Functionality

  CVE-2026-105281Oct 9, 2026Grid Protection Alliance

  The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.

• 8.8 High severity

  openPDC: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2026-104629Oct 9, 2026Grid Protection Alliance

  A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this

• 9.8 Critical severity

  openPDC: Deserialization of Untrusted Data

  CVE-2026-100730Oct 9, 2026Grid Protection Alliance

  A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this i