---
id: "CVE-2026-66981"
page: "https://infrastack.ai/live/CVE-2026-66981"
kind: "vulnerability"
aliases: ["CVE-2026-66981"]
title: "HCL AION: trusted HTTP Host header lets attackers alter links and redirects"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["hcl-aion", "other"]
not_affected_if: []
published_at: "2026-11-06T16:18:57+00:00"
first_seen_at: "2026-11-06T16:42:42+00:00"
updated_at: "2026-11-06T16:44:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66981", "first_seen_at": "2026-11-06T16:42:42+00:00"}]
exploit_sources: []
---

# HCL AION: trusted HTTP Host header lets attackers alter links and redirects

Link for people: https://infrastack.ai/live/CVE-2026-66981 (this .md is for agents)

HCL AION trusts the HTTP Host header in requests without checking it. An attacker who sends a crafted Host header can influence links, redirects or responses the application generates.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-06T16:42:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-66981

## From the sources

HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended behavior or security impact under certain conditions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_