---
id: "CVE-2026-35110"
page: "https://infrastack.ai/live/CVE-2026-35110"
kind: "vulnerability"
aliases: ["CVE-2026-35110"]
title: "HCL AION: not all requests forced over HTTPS, traffic can be intercepted"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["hcl-aion", "other", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-06T14:17:12+00:00"
first_seen_at: "2026-11-06T14:42:11+00:00"
updated_at: "2026-11-06T14:43:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35110", "first_seen_at": "2026-11-06T14:42:11+00:00"}]
exploit_sources: []
---

# HCL AION: not all requests forced over HTTPS, traffic can be intercepted

Link for people: https://infrastack.ai/live/CVE-2026-35110 (this .md is for agents)

HCL AION does not enforce encrypted HTTPS for every request, so some traffic can travel unencrypted. An attacker on the network path could intercept data sent over those connections.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-06T14:42:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-35110

## From the sources

HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_