Grid Protection Alliance openPDC and openHistorian

Multiple severe vulnerabilities in openPDC and openHistorian — including hard-coded credentials, missing authentication, and deserialization of untrusted data — expose critical infrastructure systems to full administrative compromise by unauthenticated attackers. Hard-coded credentials and missing authentication represent fundamental secure development failures that should be caught during design and code review phases. The situation is compounded by unpatched Docker images, meaning organizations relying on containerized deployments remain exposed even after vendor patches are released. Because these systems operate within energy grid infrastructure, exploitation could have cascading physical consequences beyond typical IT breaches.