---
id: "CVE-2026-35115"
page: "https://infrastack.ai/live/CVE-2026-35115"
kind: "vulnerability"
aliases: ["CVE-2026-35115"]
title: "HCL AION: missing HSTS header lets connections be downgraded or intercepted"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["hcl-aion", "other", "self-hosted"]
not_affected_if: ["not-running-aion"]
published_at: "2026-11-06T13:17:30+00:00"
first_seen_at: "2026-11-06T13:42:19+00:00"
updated_at: "2026-11-06T13:43:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35115", "first_seen_at": "2026-11-06T13:42:19+00:00"}]
exploit_sources: []
---

# HCL AION: missing HSTS header lets connections be downgraded or intercepted

Link for people: https://infrastack.ai/live/CVE-2026-35115 (this .md is for agents)

HCL AION did not send, or insecurely configured, the HTTP Strict-Transport-Security header, so browsers were not told to always use HTTPS. An attacker on the network path may be able to downgrade or intercept connections to the product.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Inspect the HTTPS response headers from the AION web endpoint (for example with `curl -I https://<aion-host>`) and look for a `Strict-Transport-Security` header
- Check the AION or reverse proxy configuration for HSTS settings

## Timeline

- 2026-11-06T13:42:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-35115

## From the sources

HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_