CVE-2026-5345 in AION
Summary
by MITRE • 11/06/2026
HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://test) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified within HCL AION represents a critical failure in transport layer security for specific components of its GenAI web interface. Specifically, a secondary WebSocket connection was implemented using the unencrypted ws:// protocol rather than the secure wss:// variant which utilizes TLS encryption. This architectural oversight creates a significant exposure vector where data transmitted between the client and server over this particular channel is sent in plaintext. In modern application architectures, particularly those involving Generative AI interfaces that may handle sensitive prompts, user inputs, or proprietary model outputs, ensuring confidentiality during transit is paramount. The use of an unencrypted protocol means that any party capable of monitoring network traffic can observe the contents of these communications without needing to bypass cryptographic protections.
From a technical perspective, this flaw aligns with CWE-319, which classifies cleartext transmission of sensitive information over a network channel. When WebSocket connections are established using ws:// instead of wss://, they lack the handshake and encryption mechanisms provided by TLS. This leaves the data stream vulnerable to passive eavesdropping attacks. An attacker positioned on the same local network segment or capable of intercepting traffic at intermediate routing points can utilize standard packet sniffing tools to capture these WebSocket frames. Because there is no encryption layer obscuring the payload, the intercepted data remains immediately readable and interpretable by the adversary.
The operational impact of this vulnerability extends beyond simple data leakage depending on the nature of the information exchanged over the GenAI interface. If the connection carries authentication tokens, session identifiers, or user credentials alongside application data, an attacker could perform session hijacking to gain unauthorized access to the system. Furthermore, if the AI model processes confidential business logic, intellectual property, or personally identifiable information within its prompts and responses, this exposure constitutes a direct breach of confidentiality requirements under regulations such as GDPR or HIPAA where applicable. The potential for unintended behavior also arises if an attacker modifies the intercepted traffic in real-time through man-in-the-middle techniques, although the primary risk here is interception due to the lack of integrity checks inherent in unencrypted channels.
This vulnerability maps directly to MITRE ATT&CK technique T1043, which covers Common Application Protocol, specifically indicating how attackers leverage standard protocols for data exfiltration or command and control when encryption is absent. It also relates to TA0001 Initial Access if the intercepted credentials are used to log in as legitimate users. The presence of this second WebSocket connection suggests a complex frontend architecture where not all communication paths were subjected to the same security review, highlighting a gap in secure development practices regarding transport layer configuration across all endpoints and connections within the application.
To mitigate this risk, immediate remediation is required by reconfiguring the secondary WebSocket endpoint to enforce wss:// protocol usage exclusively. This involves ensuring that the server presents a valid TLS certificate and that the client-side code explicitly requests an encrypted connection. Organizations should also implement strict Content Security Policy headers and ensure that their reverse proxies or load balancers are configured to terminate SSL/TLS correctly for all websocket upgrades. Regular security audits of network traffic patterns can help identify any other instances where unencrypted channels might be inadvertently exposed, ensuring comprehensive coverage of the application's attack surface against interception-based threats.