CVE-2026-29796

CVE-2026-29796 is a critical vulnerability impacting OCPP WebSocket endpoints, stemming from a lack of proper authentication mechanisms. This flaw allows unauthenticated attackers to impersonate legitimate charging stations by connecting with known identifiers, enabling them to issue or receive OCPP commands. Rated 9.4 CRITICAL, the vulnerability permits remote attackers to achieve privilege escalation, gain unauthorized control of charging infrastructure, and corrupt network data. While there is no public exploit code or evidence of active exploitation, the issue has generated some community discussion and media attention.