Missing Encryption Vulnerability in HCL AION WebSocket Connection

CVE-2026-5345

What is CVE-2026-5345?

HCL AION is susceptible to a missing encryption vulnerability due to the use of an unencrypted WebSocket protocol (ws://test) in its GenAI web interface. This flaw allows potential attackers on the network to intercept or read data exchanged over the connection, leading to possible unintended behaviors or security implications. It is recommended to use encrypted WebSocket connections (wss://) to safeguard sensitive information and maintain secure communication.

References