A critical privilege escalation vulnerability affecting Hydro-Quebec’s Le Circuit Electrique electric vehicle charging station network has been disclosed, tracked as CVE-2026-20744.
The flaw originates in the charging station’s WebSocket endpoint, which accepts connections without requiring proper authentication. Researchers found that the backend infrastructure allows unauthenticated parties to establish communication channels that should be restricted to authorized management systems. This oversight can lead to privilege escalation, enabling unauthorized users to access sensitive backend functionalities.
The vulnerability was classified as an improper access control issue within the charging network’s infrastructure. The WebSocket protocol is used by the charging stations to communicate with the central management platform for status updates, charging session data, and remote commands. Without authentication gates on these endpoints, an attacker who identifies a station’s WebSocket address can inject commands or extract operational data.
Hydro-Quebec operates one of the largest public EV charging networks in Canada, with hundreds of stations across Quebec. The Le Circuit Electrique network supports multiple connector types and provides charging services for both casual users and commercial fleets.
The utility has implemented authentication improvements for certain charging stations that rely on the OCPP protocol. However, the advisory notes that not all stations may be fully protected depending on their specific configuration and firmware version. Hydro-Quebec recommends that operators contact the company directly to verify their charging equipment’s security posture.
Security researchers noted that EV charger backend vulnerabilities are particularly concerning because they can affect multiple stations simultaneously through a single platform weakness, rather than requiring individual physical access to each charger.
