# CVE-2026-101022: Grid Protection Alliance openPDC Modbus SSRF network reconnaissance

Source: https://junglewise.ai/threats/cve-2026-101022-a-modbus-connection-feature-on-openpdc-accepts-a-caller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-101022 · Severity: medium · CVSS 4.3 · Published 2026-10-09

openPDC is a real-time power system monitoring and control platform used in critical energy infrastructure. An authenticated user can specify arbitrary internal network addresses and ports for Modbus connections, allowing attackers to map the internal network topology and identify reachable systems by exploiting the Modbus feature's lack of destination validation.

Technologies: [Grid Protection Alliance openHistorian](https://junglewise.ai/threats/technologies/openhistorian), [Grid Protection Alliance openPDC](https://junglewise.ai/threats/technologies/openpdc). Vendors: [Grid Protection Alliance](https://junglewise.ai/threats/vendors/grid-protection-alliance).

## Quick answers

**Is CVE-2026-101022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101022 being exploited in the wild.

**How severe is CVE-2026-101022?** Medium severity, with a CVSS score of 4.3, published 9 October 2026.

**Which products and versions are affected?** Grid Protection Alliance openHistorian <2.8.585; Grid Protection Alliance openPDC <2.9.482.

**Is there a fix for CVE-2026-101022?** Yes: fixed in openPDC 2.9.482 and later; openHistorian 2.8.585 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101022 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-101022?** Check whether you run Grid Protection Alliance openHistorian or Grid Protection Alliance openPDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in openPDC 2.9.482 and later; openHistorian 2.8.585 and later

## Technical details

The Modbus connection feature in openPDC fails to restrict destination addresses and ports, allowing authenticated users to trigger Server-Side Request Forgery (SSRF) attacks. By repeatedly attempting connections to different internal network destinations, an attacker can infer which hosts are reachable and map the internal network topology. The vulnerability requires prior authentication on systems using Windows Authentication, but may be reachable without authentication on other configurations.

## Affected products

- Grid Protection Alliance openPDC <2.9.482
- Grid Protection Alliance openHistorian <2.8.585

## Timeline

- 2026-10-08: advisory
- 2026-10-09: disclosed

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02)

## Related threats

- [openPDC STTP data publisher missing authentication](https://junglewise.ai/threats/cve-2026-85479-the-sttp-based-data-publisher-on-openpdc-accepts-network)
- [Grid Protection Alliance openPDC data publisher missing authentication](https://junglewise.ai/threats/cve-2026-105281-the-internal-data-publisher-on-openpdc-accepts-network)
- [Grid Protection Alliance openPDC and openHistorian deserialization and authentication vulnerabilities](https://junglewise.ai/threats/cve-2026-104629-grid-protection-alliance-openpdc-and-openhistorian)
- [Grid Protection Alliance openPDC and openHistorian unsafe deserialization](https://junglewise.ai/threats/cve-2026-100730-a-service-console-interface-on-openpdc-and-openhistorian)