CVE-2026-104629
Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.
| CWE | CWE-470 |
| Vendor | grid protection alliance |
| Product | openpdc |
| Published | Oct 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for grid protection alliance openpdc
Be the first to know when new high vulnerabilities affecting grid protection alliance openpdc are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Grid Protection Alliance / openPDC
0 < 2.9.477 0 < 2.9.482
Grid Protection Alliance / openPDC (Docker image)
0 < 2.9.477 0 < 2.9.482
Grid Protection Alliance / openHistorian
0 < 2.8.580 0 < 2.8.585
References
Credits
Shubham Raj (Cipher) of Causal Security reported this vulnerability to CISA.