Missing Encryption Vulnerability in HCL AION's WebSocket Connection

CVE-2026-21849

What is CVE-2026-21849?

HCL AION has a vulnerability related to missing encryption in the WebSocket connection established by its GenAI web interface. The use of unencrypted WebSocket protocol (ws://localhost:8000) exposes the data exchanged through this connection to potential interception by attackers on the network. This flaw can lead to unauthorized access or manipulation of sensitive information, emphasizing the necessity for implementing secure practices and upgrades to encrypted communication (wss://) to safeguard data integrity.

References