CVE-2026-104629: Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grid Protection Alliance openPDCto a version that resolves this vulnerability.Fixed in 2.9.477 - Upgrade
Upgrade
Grid Protection Alliance openHistorianto a version that resolves this vulnerability.Fixed in 2.8.580
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Deployments of Grid Protection Alliance openPDC or openHistorian are exposed when an attacker has an authenticated user account and can place a file on the host filesystem. The resulting code executes with the privileges of the affected service account.
What does an attacker need to exploit this issue?
The attacker needs a valid authenticated account plus the ability to write or otherwise place a file on the affected host filesystem. No user interaction is required.
What is the impact if exploitation succeeds?
An attacker can cause arbitrary constructor code to run by specifying a type for the component loading mechanism. That code runs under the affected service account, with high confidentiality, integrity, and availability impact.