{"id":"CVE-2026-35115","kind":"vulnerability","aliases":["CVE-2026-35115"],"related":[],"title":"HCL AION: missing HSTS header lets connections be downgraded or intercepted","description":"HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION did not send, or insecurely configured, the HTTP Strict-Transport-Security header, so browsers were not told to always use HTTPS. An attacker on the network path may be able to downgrade or intercept connections to the product.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","other","self-hosted"],"not_affected_if":["not-running-aion"],"how_to_check":"- Inspect the HTTPS response headers from the AION web endpoint (for example with `curl -I https://<aion-host>`) and look for a `Strict-Transport-Security` header\n- Check the AION or reverse proxy configuration for HSTS settings","fix":null,"status":"open","published_at":"2026-11-06T13:17:30+00:00","first_seen_at":"2026-11-06T13:42:19+00:00","triaged_at":"2026-11-06T13:43:16+00:00","updated_at":"2026-11-06T13:43:16+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T13:43:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HCL AION: missing HSTS header lets connections be downgraded or intercepted","impact":"low","summary":"HCL AION did not send, or insecurely configured, the HTTP Strict-Transport-Security header, so browsers were not told to always use HTTPS. An attacker on the network path may be able to downgrade or intercept connections to the product.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hcl-aion","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Connections downgraded or intercepted by a network attacker","analyst_note":"Sources give no affected versions, fixed version or header configuration detail; check the NVD entry and HCL advisory for specifics.","how_to_check":"- Inspect the HTTPS response headers from the AION web endpoint (for example with `curl -I https://<aion-host>`) and look for a `Strict-Transport-Security` header\n- Check the AION or reverse proxy configuration for HSTS settings\n- unknown for other checks, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["not-running-aion"],"who_is_affected":"Teams that run HCL AION and serve its web interface over HTTPS are the ones exposed. The sources do not say which AION versions or configurations are affected, so unknown. Teams that do not run AION can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000694,"input_tokens":4239,"output_tokens":540,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-35115':14A,17A 'abl':57B 'affect':69C 'aion':2A,20B,26B,67C 'allow':98C 'alway':46B,93C 'attack':50B 'behavior':109C 'browser':41B,88C 'certain':114C 'condit':115C 'configur':32B,86C 'connect':7A,62B,99C 'cve':12A,15A 'downgrad':9A,59B,102C 'hcl':1A,19B,25B,66C 'hcl-aion':18B 'header':5A,39B,81C 'host':24B 'hsts':4A,80C 'http':34B,75C 'https':48B,95C 'impact':112C 'insecur':31B,85C 'instruct':91C 'intercept':11A,61B,104C 'let':6A 'may':55B,97C 'miss':3A,83C 'network':53B 'path':54B 'potenti':105C 'product':65B 'result':106C 'secur':38B,79C,111C 'self':23B 'self-host':22B 'send':29B 'strict':36B,77C 'strict-transport-secur':35B,76C 'told':44B 'transport':37B,78C 'unintend':108C 'use':47B,94C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Teams that run HCL AION and serve its web interface over HTTPS are the ones exposed. The sources do not say which AION versions or configurations are affected, so unknown. Teams that do not run AION can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","low","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-35115':14A,17A 'aion':2A 'connect':7A 'cve':12A,15A 'downgrad':9A 'hcl':1A 'header':5A 'hsts':4A 'intercept':11A 'let':6A 'miss':3A","search_b":"'abl':57B 'aion':20B,26B 'alway':46B 'attack':50B 'browser':41B 'configur':32B 'connect':62B 'downgrad':59B 'hcl':19B,25B 'hcl-aion':18B 'header':39B 'host':24B 'http':34B 'https':48B 'insecur':31B 'intercept':61B 'may':55B 'network':53B 'path':54B 'product':65B 'secur':38B 'self':23B 'self-host':22B 'send':29B 'strict':36B 'strict-transport-secur':35B 'told':44B 'transport':37B 'use':47B","search_c":"'affect':69C 'aion':67C 'allow':98C 'alway':93C 'behavior':109C 'browser':88C 'certain':114C 'condit':115C 'configur':86C 'connect':99C 'downgrad':102C 'hcl':66C 'header':81C 'hsts':80C 'http':75C 'https':95C 'impact':112C 'insecur':85C 'instruct':91C 'intercept':104C 'may':97C 'miss':83C 'potenti':105C 'result':106C 'secur':79C,111C 'strict':77C 'strict-transport-secur':76C 'transport':78C 'unintend':108C 'use':94C 'vulner':72C","first_public_at":"2026-11-06T13:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-35115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35115","severity":null,"published_at":"2026-11-06T13:17:30+00:00","modified_at":"2026-11-06T13:17:30+00:00","first_seen_at":"2026-11-06T13:42:19+00:00","fetched_at":"2026-11-06T13:42:19+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}