Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-101022

Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grid Protection Alliance openPDC

Default version status: unaffected

  • 0 to < 2.9.477affected
  • 0 to < 2.9.482affected
  • 2.9.482unaffected

Grid Protection Alliance openPDC (Docker image)

Default version status: unaffected

  • 0 to < 2.9.477affected
  • 0 to < 2.9.482affected

Grid Protection Alliance openHistorian

Default version status: unaffected

  • 0 to < 2.8.580affected
  • 0 to < 2.8.585affected
  • 2.8.585unaffected

References