Six openPDC and openHistorian CVEs Land, and the Docker Image Gets No Fix

A network attacker who can reach the service console of Grid Protection Alliance's openPDC or openHistorian can run code under the service account unless Windows Authentication is switched on, according to CISA advisory ICSA-26-281-02, published October 8. The flaw, CVE-2026-100730, scores 9.8 on CVSS 3.1 and is fixed in openPDC 2.9.482 and openHistorian 2.8.585. The published Docker image gets no fix.

The advisory covers six CVEs in software that CISA places in the energy sector. It credits Shubham Raj (Cipher) of Causal Security with the report and says no public exploitation targeting these flaws has been reported to CISA.

Six CVEs and which ones have a fix

1. CVE-2026-100730 deserialization9.8 score
2. CVE-2026-105278 hard-coded credential9.8 score
3. CVE-2026-104629 unsafe reflection8.8 score
4. CVE-2026-105281 missing authentication7.5 score
5. CVE-2026-85479 missing authentication5.3 score
6. CVE-2026-101022 SSRF4.3 score

Source: CISA ICS advisory ICSA-26-281-02, accessed 2026-10-12

CVE	Flaw	Fix listed by CISA
CVE-2026-100730	Deserialization in service console	openPDC 2.9.482, openHistorian 2.8.585
CVE-2026-104629	Unsafe reflection in component loader	openPDC 2.9.477, openHistorian 2.8.580
CVE-2026-105281, CVE-2026-85479	Unauthenticated data publishers	Loopback default in 2.9.482 and 2.8.585, new installs only
CVE-2026-101022	SSRF through Modbus feature	None; firewall the Modbus access
CVE-2026-105278	Hard-coded admin credential in Docker image	None planned

CISA's own remediation fields are incomplete. Some entries for CVE-2026-105278 and CVE-2026-104629 are blank, so the table above is the clearest mapping the advisory supports and not a complete one.

The Docker image

The published image ships with a fixed admin credential and no forced change on first use. The advisory says "Grid Protection Alliance does not recommend production use of published Docker images in any case," and that no fix is planned for the image on five of the six CVEs.

Anyone running that image on a network that other hosts can reach should treat the admin credential as public.

What the scores leave out

The score overstates CVE-2026-100730 for deployments with Windows Authentication enabled. The advisory says an attacker must already be authenticated there, yet the 9.8 vector assumes no privileges.

The score understates the two missing-authentication flaws. The loopback default applies only to new installations, so existing deployments keep their old binding and the advisory tells operators to "verify their configuration explicitly." CVE-2026-105281 rates 7.5, but it exposes device and measurement topology to anyone who connects, which is reconnaissance data about the monitored network.

OpenCVE records the CNA as CISA's ICS-CERT and gives CVE-2026-100730 an EPSS of 0.00625, under 1%. It is not in CISA's exploited catalogue.

Finding the fixed builds

The project's GitHub releases page, as fetched on October 12, lists v2.9.148 as the latest release, dated March 31, 2022, with a v2.9.318 build marked as a pre-release. Neither 2.9.477 nor 2.9.482 appeared there. The advisory does not say where operators should download them, so confirm the build number from the vendor before treating a host as patched.

Operators should check the console binding on every existing install, update to 2.9.482 or 2.8.585, and keep the Docker image away from production. CISA's general advice is to keep control system networks off the internet and behind firewalls. The agency's Flax Typhoon advisory and its October 8 KEV additions show how often the bugs defenders are told to fix are old ones.