HCL AION · CVE-2026-21849 · AI agents & MCP
FIX → 2.8.0 ✓ verified
The GenAI web interface in HCL AION opens its WebSocket connection over plain ws:// (ws://localhost:8000) rather than encrypted wss://. An attacker on the network path could read or alter data exchanged over that connection.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running HCL AION 2.6.0 with the GenAI web interface, whose WebSocket connection is set up as ws://localhost:8000 instead of wss://. Data on that connection could be read by an attacker on the network path; traffic that stays on one machine is a smaller risk. Teams not running HCL AION, or already on 2.8.0, can skip it.
Not affected if no-network-exposure, not-hcl-aion
Who cares genai, hcl-aion, websocket
Upgrade to 2.8.0
HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://localhost:8000) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade HCL AION to v2.8.0 (remediated there per HCL); HCL AION support team assists with the upgrade.