HCL AION · CVE-2026-5345 · AI agents & MCP
FIX → 2.8.0 ✓ verified
HCL AION's GenAI web interface opens a second WebSocket connection using unencrypted ws:// instead of wss://. An attacker on the network path could read or intercept data exchanged over that connection.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running HCL AION V 2.6.0 with the GenAI web interface are affected: a second WebSocket connection in that interface used unencrypted ws:// instead of wss://, so someone on the network path could read or intercept the data. HCL rates it low (CVSS 3.7, high attack complexity). Deployments on 2.8.0 or later, or where all traffic stays on a trusted network, can skip it. HCL does not say whether the ws:// endpoint is configurable.
Not affected if unknown
Who cares genai, hcl-aion, self-hosted, websocket
2.6.0 is listed as affectedUpgrade to 2.8.0
HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://test) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade HCL AION to 2.8.0 (HCL: remediated as part of v2.8.0; HCL AION support team assists customers on older versions).