CVE-2026-21849
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 06, 2026
Vendor
unknown
Description
HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://localhost:8000) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.