Log in Start free

Vulnerability · Published Oct 9, 2026 · Assigned by icscert

CVE-2026-104629Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code

High 8.8

In plain English

A high-severity security flaw in openHistorian from Grid Protection Alliance. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 72.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.

Affected products (as reported)

VendorProductVersions
Grid Protection Alliance openPDC 0 – before 2.9.4770 – before 2.9.482
Grid Protection Alliance openPDC (Docker image) 0 – before 2.9.4770 – before 2.9.482
Grid Protection Alliance openHistorian 0 – before 2.8.5800 – before 2.8.585

Weakness: CWE-470 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References