Content-Security-Policy Misconfiguration in HCL AION

CVE-2026-21834

What is CVE-2026-21834?

HCL AION is impacted by a significant security misconfiguration involving the lack of a Content-Security-Policy (CSP) header in its application responses. This omission allows browsers to fetch scripts and other content from unverified sources. Consequently, attackers could exploit this gap to launch cross-site scripting (XSS) and content-injection attacks. Such vulnerabilities may lead to unauthorized actions and can severely compromise user security and data integrity under specific conditions.

References