Missing Security Role Enforcement on Grafana API

Date Published: November 03, 2026

Affects: openPDC v2.9.497 and earlier, openHistorian v2.8.603 and earlier

Severity: Low

Overview

A critical vulnerability has been identified in both openPDC and openHistorian, which allows a user with no roles to access data via the Grafana API.

Vulnerability Details

The vulnerability allows an attacker with an authorized user account but no associated roles to access data via the Grafana API.

Impact

If successfully exploited, an attacker could:

Potentially gain access to the data stored in the system.

The severity of this vulnerability is low since a successful attack requires access to an authorized account without View access.

Mitigation/Remediation

GPA has added additional role validation logic in openHistorian version 2.8.604 and later and openPDC version 2.9.498 and later.

In the meantime the following actions can prevent an attacker from exploiting this vulnerability:

Restrict system permissions: Apply the principle of least privilege to all users.

Ensure password complexity requirements are sufficient: In order to exploit this vulnerability an attacker may need access to an authenticated user account.

Disclaimer

The information provided in this advisory is provided "as is" and does not guarantee the security of systems. We strongly recommend that users apply patches as soon as they are available and follow best practices for securing systems against known vulnerabilities.

GPA credits kta1kri for identifying this vulnerability and supporting resolution of the issue.