---
id: "CVE-2026-21849"
page: "https://infrastack.ai/live/CVE-2026-21849"
kind: "vulnerability"
aliases: ["CVE-2026-21849"]
title: "HCL AION: GenAI web interface WebSocket traffic sent unencrypted"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "HCL AION", "fixed": ["2.8.0"], "affected": "2.6.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-tooling", "genai", "hcl-aion", "websocket"]
not_affected_if: ["no-network-exposure", "not-hcl-aion"]
published_at: "2026-11-06T14:17:11+00:00"
first_seen_at: "2026-11-06T14:42:11+00:00"
updated_at: "2026-11-06T14:45:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21849", "first_seen_at": "2026-11-06T14:42:11+00:00"}, {"source": "analyst", "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118", "first_seen_at": "2026-11-06T14:45:28+00:00", "cites": ["https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118"]}]
exploit_sources: []
---

# HCL AION: GenAI web interface WebSocket traffic sent unencrypted

Link for people: https://infrastack.ai/live/CVE-2026-21849 (this .md is for agents)

The GenAI web interface in HCL AION opens its WebSocket connection over plain ws:// (ws://localhost:8000) rather than encrypted wss://. An attacker on the network path could read or alter data exchanged over that connection.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HCL AION affected 2.6.0 fixed 2.8.0

## How to check

- Check your HCL AION version: HCL lists V2.6.0 as affected for this CVE; v2.8.0 contains the fix. V2.7.0 is listed in the bulletin only for other CVEs, not this one.
- If the GenAI web interface is deployed, check whether its WebSocket connection uses ws://localhost:8000 (unencrypted) instead of wss://.

## Fix

Upgrade HCL AION to v2.8.0 (remediated there per HCL); HCL AION support team assists with the upgrade.

## Timeline

- 2026-11-06T14:42:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-21849
- 2026-11-06T14:45:28+00:00 analyst https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118 — Read HCL bulletin KB0135118 (4 Nov 2026) via browser: CVE-2026-21849 lists HCL AION V2.6.0 as affected; fixed in v2.8.0. No config workaround stated. Same bulletin covers sibling CVE-2026-5345 (ws://test).

## Documents

- [advisory] HCL Security Bulletin KB0135118: Multiple security vulnerabilities affect HCL AION https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118

## From the sources

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://localhost:8000) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_