CVE-2026-104629

openPDC and openHistorian, both from the Grid Protection Alliance, have a component-loading flaw (CWE-470) in which the service constructs and runs a type named by input, including types that are not valid components. An attacker who already has an authenticated account and can place a file on the host filesystem can cause arbitrary constructor code in that file to run with the privileges of the affected service account. Impact is high confidentiality, integrity, and availability on the vulnerable system, but the attack does not cross into other security scopes and requires both authentication and local file placement. Affected deployments are operators of these grid phasor-data and historian products; no affected version range is stated in the advisory data. There is no known public proof of concept, and the issue is not listed in CISA KEV.

What to do: Treat authenticated accounts and any path that can drop files onto hosts running openPDC or openHistorian as high risk, and restrict both to the minimum needed. Run the services under a least-privilege account, block untrusted assemblies from the load path, and apply Grid Protection Alliance fixes as soon as they are published. Review logs and the filesystem for unexpected components or newly placed files that the service might load.