The Cybersecurity and Infrastructure Security Agency has warned that Grid Protection Alliance openPDC and openHistorian contain vulnerabilities affecting energy-sector deployments worldwide. The advisory covers openPDC, the vendor’s published Docker image, and openHistorian. The most severe issue is rated critical, with a CVSS v3.1 score of 9.8. (CISA advisory)

CVE-2026-100730 affects a service console interface that deserializes a data structure supplied by a client. CISA says an attacker could provide an arbitrary object graph and potentially execute code under the privileges of the affected service account.

The exposure depends partly on the authentication configuration. On systems using Windows Authentication, an attacker must already be authenticated to reach the vulnerable function. On systems without Windows Authentication, the function can be reached by an unauthenticated network attacker.

Grid Protection Alliance added validation to the relevant serialization logic in openPDC version 2.9.482 and later and openHistorian version 2.8.585 and later. The advisory identifies the affected products as known affected and lists those versions as the vendor remediation for the software products.

The published Docker image remains a separate concern. CISA says the fix for CVE-2026-100730 has not been published to that image. Grid Protection Alliance does not recommend production use of its published Docker images, according to the advisory.

Two additional vulnerabilities involve publisher interfaces that accept network connections without authentication in their default configurations. CVE-2026-105281 affects the internal data publisher. An unauthenticated network attacker can connect to the interface and retrieve the system’s complete device and measurement topology. CISA rates the issue 7.5 under CVSS v3.1.

The vendor changed the default configuration for the internal publisher so that it binds to the local loopback address only. The change applies to new installations, but it does not automatically alter the configuration of systems upgraded from earlier versions. Operators therefore need to verify the interface binding on existing installations and change it if the service still accepts connections on all network interfaces.

CVE-2026-85479 concerns the STTP-based data publisher. In its default configuration, the interface also accepts unauthenticated network connections. CISA says an unauthenticated network attacker can connect to the interface and exchange data with it. The vulnerability carries a CVSS v3.1 score of 7.5.

The listed remediation for the STTP-based publisher is the same loopback-binding change used for the internal publisher. New installations receive the updated default, while upgraded installations retain their previous settings unless operators review and change them. The published Docker image remains affected, and CISA says the corresponding fix has not been published there.

The advisory’s summary identifies deserialization of untrusted data, missing authentication for a critical function, server-side request forgery, hard-coded credentials, and unsafe reflection involving externally controlled input among the vulnerability categories associated with the affected products. The detailed entries identify the deserialization issue and the two unauthenticated publisher interfaces described above.

For openPDC and openHistorian deployments, the remediation steps are version-specific. Operators should move the software products to the listed fixed versions where applicable, review whether Windows Authentication is enabled, and check the network binding of both publisher interfaces on systems upgraded from earlier releases. Deployments using the published Docker image require separate consideration because the advisory does not list the described fixes as available for that image.