Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2026-85479: openPDC and openHistorian let anyone send data
CVE-2026-85479 · published 26 days ago
Summary
By default, the data publishing function in openPDC and openHistorian does not require a username or password. This means a person on the same network could connect and insert or alter data without permission. Change the configuration to require authentication and limit network access to trusted systems, or apply any available security updates.
What to do
- Update grid protection alliance openpdc to version 2.9.477 or later.
- Update grid protection alliance openpdc (docker image) to version 2.9.477 or later.
- Update grid protection alliance openhistorian to version 2.8.580 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| grid protection alliance | openpdc | < 2.9.477 |
| grid protection alliance | openpdc (docker image) | < 2.9.477 |
| grid protection alliance | openhistorian | < 2.8.580 |
Original advisory text
Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
6.9
Medium
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published9 Oct 2026
Updated4 Nov 2026
First seen9 Oct 2026
Track software like this
Free during beta