CVE-2026-66981

HCL AION uses unvalidated host information to generate links

HCL Software · HCL AION

First documented disclosure · Review checkpoint

Summary

Unvalidated host information shapes generated links. Links or redirects generated by the service can point somewhere the application operator did not intend.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The application trusts request-supplied host information when forming responses.

Conditions required

The CNA score describes a network actor with low privileges and user interaction.

Potential impact

Links or redirects generated by the service can point somewhere the application operator did not intend.

Affected versions and configurations

2.7.0.

Fix and mitigation status

2.8.0.

Practical next steps

Upgrade HCL AION to 2.8.0 and verify the affected control in the deployed interface.

Operating lesson

Build public links from a trusted origin or validate allowed hosts.

Evidence and limits

HCL bulletin KB0135217 was published 2026-11-06 and identifies 2.8.0 as the fix.

Sources