{"id":"CVE-2026-5345","kind":"vulnerability","aliases":["CVE-2026-5345"],"related":[],"title":"HCL AION: GenAI web interface sends data over unencrypted WebSocket","description":"HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://test) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION's GenAI web interface opens a second WebSocket connection using unencrypted ws:// instead of wss://. An attacker on the network path could read or intercept data exchanged over that connection.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"HCL AION","fixed":["2.8.0"],"affected":"V 2.6.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","genai","hcl-aion","self-hosted","websocket"],"not_affected_if":["unknown"],"how_to_check":"Check your HCL AION version: V 2.6.0 is listed as affected. Also look in the GenAI web interface's browser dev tools (Network > WS) for connections that start with ws:// rather than wss://. The bulletin does not say whether the endpoint can be configured.","fix":"Upgrade HCL AION to 2.8.0 (HCL: remediated as part of v2.8.0; HCL AION support team assists customers on older versions).","status":"open","published_at":"2026-11-06T14:17:13+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","triaged_at":"2026-11-06T14:43:48+00:00","updated_at":"2026-11-06T14:45:36+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-06T14:43:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HCL AION: GenAI web interface sends data over unencrypted WebSocket","impact":"low","summary":"HCL AION's GenAI web interface opens a second WebSocket connection using unencrypted ws:// instead of wss://. An attacker on the network path could read or intercept data exchanged over that connection.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["hcl-aion","genai","websocket"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Data on the GenAI WebSocket channel is readable by network observers","analyst_note":"Find the affected AION versions and the fixed release in HCL's advisory, and confirm whether the ws:// endpoint is configurable.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running HCL AION with the GenAI web interface are exposed when traffic between users and the server crosses a network an attacker can observe. The sources do not say which AION versions are affected or which settings change the exposure, so the check and fix details are unknown. Deployments where all traffic stays on a trusted network path carry less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000663,"input_tokens":4263,"output_tokens":473,"severity_before":"low"},"analyst_status":"done","analyst_note":"Find the affected AION versions and the fixed release in HCL's advisory, and confirm whether the ws:// endpoint is configurable.","search":"'-2026':12A,15A '-5345':13A,16A 'affect':63C 'ai':20B 'ai-tool':19B 'aion':2A,18A,25B,31B,61C 'allow':95C 'attack':46B,108C 'behavior':116C 'certain':121C 'channel':92C 'condit':122C 'connect':40B,59B,73C,81C,100C 'could':51B 'cve':11A,14A 'data':7A,55B,96C 'defin':74C 'encrypt':67C,91C 'exchang':56B,97C 'genai':3A,22B,33B,77C 'hcl':1A,17A,24B,30B,60C 'hcl-aion':23B 'host':28B 'impact':119C 'instead':43B,88C 'intercept':54B,103C 'interfac':5A,35B,79C 'may':94C 'miss':66C 'network':49B,111C 'open':36B 'path':50B 'potenti':112C 'protocol':86C 'read':52B,105C 'result':113C 'second':38B,71C 'secur':118C 'self':27B 'self-host':26B 'send':6A 'test':87C 'tool':21B 'unencrypt':9A,42B,84C 'unintend':115C 'use':41B,82C 'vulner':68C 'web':4A,34B,78C 'websocket':10A,29B,39B,72C,85C","nicknames":[],"mitigations":[],"who_affected":"Teams running HCL AION V 2.6.0 with the GenAI web interface are affected: a second WebSocket connection in that interface used unencrypted ws:// instead of wss://, so someone on the network path could read or intercept the data. HCL rates it low (CVSS 3.7, high attack complexity). Deployments on 2.8.0 or later, or where all traffic stays on a trusted network, can skip it. HCL does not say whether the ws:// endpoint is configurable.","tier":"B","verified":{"fix":{"at":"2026-11-06T14:45:36Z","by":"analyst","doc":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118","run_id":1897},"products":{"at":"2026-11-06T14:45:36Z","by":"analyst","doc":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118","run_id":1897},"who_affected":{"at":"2026-11-06T14:45:36Z","by":"analyst","doc":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118","run_id":1897}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["aion","hclaion"],"ptokens":["aion","hcl"],"labels":["aitooling","genai","hclaion","low","selfhosted","websocket"],"campaign_type":null,"search_a":"'-2026':12A,15A '-5345':13A,16A 'aion':2A,18A 'cve':11A,14A 'data':7A 'genai':3A 'hcl':1A,17A 'interfac':5A 'send':6A 'unencrypt':9A 'web':4A 'websocket':10A","search_b":"'ai':20B 'ai-tool':19B 'aion':25B,31B 'attack':46B 'connect':40B,59B 'could':51B 'data':55B 'exchang':56B 'genai':22B,33B 'hcl':24B,30B 'hcl-aion':23B 'host':28B 'instead':43B 'intercept':54B 'interfac':35B 'network':49B 'open':36B 'path':50B 'read':52B 'second':38B 'self':27B 'self-host':26B 'tool':21B 'unencrypt':42B 'use':41B 'web':34B 'websocket':29B,39B","search_c":"'affect':63C 'aion':61C 'allow':95C 'attack':108C 'behavior':116C 'certain':121C 'channel':92C 'condit':122C 'connect':73C,81C,100C 'data':96C 'defin':74C 'encrypt':67C,91C 'exchang':97C 'genai':77C 'hcl':60C 'impact':119C 'instead':88C 'intercept':103C 'interfac':79C 'may':94C 'miss':66C 'network':111C 'potenti':112C 'protocol':86C 'read':105C 'result':113C 'second':71C 'secur':118C 'test':87C 'unencrypt':84C 'unintend':115C 'use':82C 'vulner':68C 'web':78C 'websocket':72C,85C","first_public_at":"2026-11-06T14:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-5345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5345","severity":null,"published_at":"2026-11-06T14:17:13+00:00","modified_at":"2026-11-06T14:17:13+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","fetched_at":"2026-11-06T14:42:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-5345:1897","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118","severity":null,"published_at":"2026-11-06T14:45:36+00:00","modified_at":"2026-11-06T14:45:36+00:00","first_seen_at":"2026-11-06T14:45:36+00:00","fetched_at":"2026-11-06T14:45:36+00:00","note":"HCL bulletin KB0135118 (published 4 Nov 2026) lists CVE-2026-5345 under HCL AION V 2.6.0; remediated in v2.8.0. Bulletin does not say if ws endpoint is configurable; no exploitation or PoC seen. Page is JS-only, read via browser-cli.","cites":["https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118"]}],"documents":[{"id":87158,"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118","title":"HCL Security Bulletin KB0135118: Multiple security vulnerabilities affect HCL AION","kind":"advisory","source":"analyst","publisher":null,"text":"HCL Security Bulletin KB0135118 (published 4 Nov 2026): Multiple security vulnerabilities affect HCL AION.\nCVE-2026-21849: missing encryption in the WebSocket connection set up by the GenAI web interface; used ws://localhost:8000 instead of wss://. CVSS 3.7.\nAffected: HCL AION V 2.6.0 (lists CVE-2026-21849). V 2.7.0 is listed only for four other CVEs.\nRemediation: \"As a part of HCL AION v2.8.0, this issue has been remediated. For customers using older version, mitigation path will include upgrade to version 2.8.0 ... HCL AION support team will provide required assistance.\"\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}