CVE-2026-105281

Summary

The openPDC's internal data publisher allows unauthenticated connections in its default configuration, enabling attackers to retrieve complete device and measurement topology information without any credentials. This represents a significant information disclosure vulnerability that could expose critical infrastructure mapping details to unauthorized parties.

Exploitability

Exploitation is straightforward with no prerequisites as the service runs unauthenticated by default, requiring only network access to the affected interface.

Blast radius

The impact could be substantial across industrial control systems and smart grid environments where openPDC is deployed, potentially exposing sensitive operational topology data to attackers who can then plan targeted attacks on critical infrastructure components.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the internal data publisher service or restrict network access to the affected interface until a patched version is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.