CVE-2026-101022
Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 9, 2026
- Updated
- Oct 9, 2026
- Reserved
- Oct 5, 2026
Description
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | icscert |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
openPDCGrid Protection Alliance |
|
openPDC (Docker image)Grid Protection Alliance |
|
openHistorianGrid Protection Alliance |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.