Priority MEDIUM 42
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use.
Vulnerabilities
6 records
TI-2026-70023 CVE-2026-104629 · GHSA-68jv-q5j2-rgqm
Unsafe reflection in Grid Protection Alliance openPDC and openHistorian
Priority LOW 36
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load.
TI-2026-70018 CVE-2026-101022 · GHSA-q8fp-gfvc-6mwj
Server-side request forgery in openPDC and openHistorian
Priority LOW 23
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted.
TI-2026-70004 CVE-2026-85479 · GHSA-xr5w-f3rm-m5gq
Missing authentication in openPDC and openHistorian data publisher
Priority LOW 36
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration.
TI-2026-70024 CVE-2026-105281 · GHSA-cg72-3fmm-q6mm
Missing authentication in Grid Protection Alliance openPDC and openHistorian
Priority MEDIUM 43
The internal data publisher on openPDC accepts network connections without authentication in its default configuration.
TI-2026-70017 CVE-2026-100730 · GHSA-g2gc-jv32-q89f
Untrusted data deserialization in openPDC and openHistorian
Priority MEDIUM 49
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure.