Inside openPDC: six vulnerabilities, two Critical, in power-grid software used worldwide

A power-grid operator can only act on the measurements their systems deliver. In synchrophasor monitoring, those measurements pass through a phasor data concentrator (PDC), which collects time-synchronized readings from devices across substations, aligns them, and forwards them to control-center applications and historians. An attacker who controls the concentrator can interfere with which readings are collected and forwarded, and so with operators’ view of the grid.

Cipher autonomously discovered six vulnerabilities in Grid Protection Alliance’s openPDC and openHistorian, including two Critical issues rated CVSS 9.8: unsafe deserialization on the service console, reachable without authentication in some configurations, and a fixed administrative password in the published Docker image. The others expose the measurement topology, run constructor code before verifying an adapter’s type, or let an authenticated user probe network destinations the concentrator can reach. Cipher validated all six against running software in an isolated test environment.

CISA published the findings on 8 October 2026 in ICSA-26-281-02, which lists the products as deployed worldwide in the energy sector. Grid Protection Alliance has shipped fixes for four of them in supported releases; the Modbus issue has a network mitigation, and the published Docker image remains unpatched.

Why the deployment model matters

The six do not share preconditions, and a Windows installation, a Linux deployment, and the published Docker image are exposed differently.

• Service console deserialization (CVE-2026-100730): requires reaching the service console (default port 8500). With Windows Authentication enabled, the attacker must already be authenticated. Without it, including on Linux, where it is unavailable, no authentication is needed.
• Fixed Docker credential (CVE-2026-105278): applies only to the published Docker image. The Windows installer requires an administrative password at setup.
• Unauthenticated publishers (CVE-2026-105281 and CVE-2026-85479): accept unauthenticated connections by default. Updated builds bind them to loopback on new installations only; upgrades keep existing bindings.
• Adapter loading (CVE-2026-104629) and Modbus SSRF (CVE-2026-101022): both require an authenticated account, which the Docker image’s fixed credential can supply. The adapter finding also requires placing an assembly on the host filesystem.

Grid Protection Alliance discourages production use of its Docker images, which are intended for testing and education and do not include the security fixes.

1. Deserialization before authentication on the service console (CVE-2026-100730)

Impact: A client that reaches the console can make the server deserialize an arbitrary object graph before authentication completes, which can lead to code execution with the service account’s privileges. CISA rates it Critical, CVSS 9.8.

The console’s remoting receive path, in the shared Grid Solutions Framework, hands the first client message to a BinaryFormatter-based deserializer before checking whether the client may use the channel:

deserialize first client message   // untrusted objects are instantiated here
check channel authentication       // authorization comes afterward

Cipher confirmed the order on a running instance: the server deserialized a Hashtable, not the ClientInfo object the channel expects, and only then returned an authentication failure. Type names resolved across loaded assemblies without an allowlist.

The test instance was the Docker image on Mono, where this path did not lead to code execution. CISA and the vendor both identify the behavior as potentially allowing remote code execution, and the vendor warns specifically about systems without Windows Authentication. The fix adds serialization validation in openPDC 2.9.482 and openHistorian 2.8.585.

2. A fixed administrative password in the Docker image (CVE-2026-105278)

Impact: Anyone who can reach the management interface of an unchanged Docker deployment can log in with the shipped credential and take full administrative control of the application. CISA rates it Critical, CVSS 9.8.

The image seeds an administrator account with a documented default password and never requires a change. The service also runs as root inside the container, so the adapter flaw below would execute with root privileges, though it additionally requires placing an assembly on the host filesystem.

No fix has been published for the image, and changing the password does not address the other unpatched flaws.

3. An adapter constructor executes before type validation (CVE-2026-104629)

Impact: The loader constructs a named type before checking that it is an adapter, so constructor code runs with the service account’s privileges even when the type is then rejected. CISA rates it High, CVSS 8.8.

Custom adapters are an intended extension point; the problem is the order of operations:

load the named assembly
construct the named type   // constructor code executes
cast to IAdapter           // a non-adapter fails only afterward

Cipher validated this with a non-adapter type whose constructor wrote a proof file: the constructor ran as the service account before the service logged the failed cast. The finding requires an authenticated account (the Editor role was sufficient) and the ability to place an assembly on the host filesystem.

The fix adds adapter verification and integrity checks in openPDC 2.9.477 and openHistorian 2.8.580. The vendor’s notice also recommends restricting write access to the application folder.

4. An unauthenticated publisher exposes the measurement topology (CVE-2026-105281)

Impact: The internal data publisher accepts unauthenticated connections by default and returns the complete device and measurement topology. CISA rates it High, CVSS 7.5.

The publisher required no authentication and listened on all interfaces. Cipher connected without credentials, requested metadata, and received a dataset describing every configured measurement, device, and signal type. That is a map of the PMUs and measurement points the concentrator watches.

In openPDC 2.9.482 and openHistorian 2.8.585 the default binding is loopback, but only for new installations. Upgraded installations keep their old listener configuration, so operators must change it themselves.

5. The STTP publisher accepts unauthenticated connections (CVE-2026-85479)

Impact: The STTP-based publisher has the same unauthenticated default. CISA rates it Medium, CVSS 5.3.

Cipher confirmed that an unauthenticated client could connect and exchange framed commands; unlike the internal publisher, it did not yield the topology. The same loopback fix and upgrade caveat apply.

6. A Modbus connection feature becomes an internal network probe (CVE-2026-101022)

Impact: An authenticated user can make the application open a Modbus/TCP connection to any host and port, turning the concentrator into a probe for internal addresses the user cannot reach directly. CISA rates it Medium, CVSS 4.3.

The destination in the connection string was not checked against an allowlist or blocked from loopback and private ranges. In the test environment, a reachable internal service accepted Cipher’s connection and a closed port refused it, a difference that supports mapping the internal network.

Grid Protection Alliance recommends a firewall mitigation rather than a code fix: restrict Modbus network access and block loopback and private (RFC 1918) destinations unless required.

Remediation

For operators of openPDC or openHistorian:

1. Upgrade to openPDC 2.9.482 and openHistorian 2.8.585 or later, which include the earlier adapter fix.
2. Recheck publisher bindings after upgrading. Set the internal and STTP publishers to loopback where remote subscribers are not needed, or firewall them.
3. Keep the Docker image out of production. If one is still running, change the default password and isolate its management and console interfaces while you migrate.
4. Restrict the console and Modbus paths. Limit console access (default port 8500) to trusted administrators, and restrict Modbus egress to intended destinations.
5. Check other Grid Solutions Framework products. The console and publisher code is shared; ask the vendor whether a downstream product carries the fixes.

For maintainers: authenticate before deserializing; replace BinaryFormatter with a type-safe serializer or strictly constrain accepted types; validate adapter types before construction; require authentication and safe bindings for publishers; enforce server-side destination restrictions for Modbus; and run services with least privilege.

Coordinated disclosure

Cipher discovered and validated the issues, and Causal Security reported them to Grid Protection Alliance and CISA. Grid Protection Alliance published vendor notices in July 2026 and released fixes for supported packages. CISA published ICSA-26-281-02 on 8 October 2026, crediting Shubham Raj (Cipher) of Causal Security. We thank Grid Protection Alliance for the fixes and the CISA ICS team for coordinating the disclosure.

Scores are CISA’s CVSS v3.1 assessments. Grid Protection Alliance’s earlier vendor notices rate some findings lower.

This work is part of our vulnerability research into open-source and embedded software used inside critical systems.