{"schema":"threatline.record/2","record":{"id":"CVE-2026-105281","aliases":[],"summary":"Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function","details":"The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.","categories":["Unclassified"],"product":"openPDC","vendor":"Grid Protection Alliance","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105281","source_modified_at":"2026-10-11T17:05:29.198Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"openPDC","vendor":"Grid Protection Alliance","versions":[{"status":"affected","version":"0","lessThan":"2.9.477","versionType":"custom"},{"status":"affected","version":"0","lessThan":"2.9.482","versionType":"custom"},{"status":"unaffected","version":"2.9.482"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105281","source_modified_at":"2026-10-11T17:05:29.198Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"openPDC (Docker image)","vendor":"Grid Protection Alliance","versions":[{"status":"affected","version":"0","lessThan":"2.9.477","versionType":"custom"},{"status":"affected","version":"0","lessThan":"2.9.482","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105281","source_modified_at":"2026-10-11T17:05:29.198Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"openHistorian","vendor":"Grid Protection Alliance","versions":[{"status":"affected","version":"0","lessThan":"2.8.580","versionType":"custom"},{"status":"affected","version":"0","lessThan":"2.8.585","versionType":"custom"},{"status":"unaffected","version":"2.8.585"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105281","source_modified_at":"2026-10-11T17:05:29.198Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"openPDC","ecosystem":null},"version":"2.9.477","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105281","source_modified_at":"2026-10-11T17:05:29.198Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"openPDC","ecosystem":null},"version":"2.9.482","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105281","source_modified_at":"2026-10-11T17:05:29.198Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"openPDC (Docker image)","ecosystem":null},"version":"2.9.477","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105281","source_modified_at":"2026-10-11T17:05:29.198Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"openPDC (Docker image)","ecosystem":null},"version":"2.9.482","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105281","source_modified_at":"2026-10-11T17:05:29.198Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"openHistorian","ecosystem":null},"version":"2.8.580","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105281","source_modified_at":"2026-10-11T17:05:29.198Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"openHistorian","ecosystem":null},"version":"2.8.585","basis":"first unaffected version stated in the CVE record"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00312,"percentile":0.22923,"score_date":"2026-10-23"},"published_at":"2026-10-09T13:49:06.352Z","modified_at":"2026-10-11T17:05:29.198Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105281","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-11T17:05:29.198Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105281","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02"},{"source":"CVE List","url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-11T16:50:59.366985Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-11T17:05:29.198Z","content_hash":"c0e6bbb8e1675c3a9129b56f73e275b25d119bd395e2f782f28fffd0295cfb68"}}