CVE-2026-35115 · Other
NO FIX YET
HCL AION did not send, or insecurely configured, the HTTP Strict-Transport-Security header, so browsers were not told to always use HTTPS. An attacker on the network path may be able to downgrade or intercept connections to the product.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run HCL AION and serve its web interface over HTTPS are the ones exposed. The sources do not say which AION versions or configurations are affected, so unknown. Teams that do not run AION can skip it.
Not affected if not-running-aion
Who cares hcl-aion, self-hosted
curl -I https://<aion-host>) and look for a Strict-Transport-Security headerNo fix yet, per the sources.
HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.