CISA details five flaws in energy-sector tools openPDC and openHistorian

CISA has published an advisory covering five vulnerabilities in Grid Protection Alliance's openPDC and openHistorian, software deployed worldwide in the energy sector for grid data collection and storage. The advisory sets out affected versions, remediation status and mitigation steps for operators running these systems, with Docker image deployments left without a vendor fix for several of the flaws.

• CISA's advisory lists five vulnerabilities affecting openPDC versions below 2.9.477/2.9.482 and openHistorian versions below 2.8.580/2.8.585.
• CVE-2026-100730 and CVE-2026-105278 each carry a CVSS 3.1 base score of 9.8, rated critical.
• Grid Protection Alliance has no fix planned for the Docker image and does not recommend its production use, per the advisory.
• A Modbus connection feature (CVE-2026-101022) lets an authenticated user target arbitrary internal network destinations, enabling internal network mapping.
• Shubham Raj of Causal Security reported the vulnerabilities to CISA, which released the advisory on 8 October 2026.