CVE-2026-105281

The internal data publisher in Grid Protection Alliance openPDC accepts network connections without authentication when left in its default configuration. An unauthenticated attacker who can reach that interface over the network can connect and retrieve the system's complete device and measurement topology. The impact is high confidentiality loss of grid measurement layout data, with no integrity or availability impact scored. Affected deployments are openPDC systems using that default publisher; the advisory data does not name a version range. It is not in CISA KEV and no public exploit is known.

What to do: Keep the openPDC internal data publisher off untrusted and internet-facing networks, and restrict it with firewall rules to only the hosts that must receive measurement data. Check the Grid Protection Alliance and CISA ICS advisory for this CVE and apply any authentication or configuration fix they publish; no patched version is named in the data provided. Review publisher listeners and access logs for unexpected unauthenticated connections that may have retrieved device or measurement topology.