---
id: "CVE-2026-5345"
page: "https://infrastack.ai/live/CVE-2026-5345"
kind: "vulnerability"
aliases: ["CVE-2026-5345"]
title: "HCL AION: GenAI web interface sends data over unencrypted WebSocket"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "HCL AION", "fixed": ["2.8.0"], "affected": "V 2.6.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-tooling", "genai", "hcl-aion", "self-hosted", "websocket"]
not_affected_if: ["unknown"]
published_at: "2026-11-06T14:17:13+00:00"
first_seen_at: "2026-11-06T14:42:11+00:00"
updated_at: "2026-11-06T14:45:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5345", "first_seen_at": "2026-11-06T14:42:11+00:00"}, {"source": "analyst", "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118", "first_seen_at": "2026-11-06T14:45:36+00:00", "cites": ["https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118"]}]
exploit_sources: []
---

# HCL AION: GenAI web interface sends data over unencrypted WebSocket

Link for people: https://infrastack.ai/live/CVE-2026-5345 (this .md is for agents)

HCL AION's GenAI web interface opens a second WebSocket connection using unencrypted ws:// instead of wss://. An attacker on the network path could read or intercept data exchanged over that connection.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HCL AION affected V 2.6.0 fixed 2.8.0

## How to check

Check your HCL AION version: V 2.6.0 is listed as affected. Also look in the GenAI web interface's browser dev tools (Network > WS) for connections that start with ws:// rather than wss://. The bulletin does not say whether the endpoint can be configured.

## Fix

Upgrade HCL AION to 2.8.0 (HCL: remediated as part of v2.8.0; HCL AION support team assists customers on older versions).

## Timeline

- 2026-11-06T14:42:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-5345
- 2026-11-06T14:45:36+00:00 analyst https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118 — HCL bulletin KB0135118 (published 4 Nov 2026) lists CVE-2026-5345 under HCL AION V 2.6.0; remediated in v2.8.0. Bulletin does not say if ws endpoint is configurable; no exploitation or PoC seen. Page is JS-only, read via browser-cli.

## Documents

- [advisory] HCL Security Bulletin KB0135118: Multiple security vulnerabilities affect HCL AION https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118

## From the sources

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://test) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_