CVE-2026-111443 Details
Description
Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug escalation. It can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. This is fixed in 4.2.0.
A vulnerability in Wheels versions 4.0.6 through 4.1.2 allows unauthenticated clients to switch requests into a separate test application context, including in production environments. This is achieved by sending an 'X-Wheels-Test-Context' header or 'WHEELS_TEST_CONTEXT' cookie with any value, or by including a test-runner path in the URL, even in the query string. The alternate application shares the same configuration, environment, datasource, and debug settings. While this does not bypass authentication or escalate data or debug access, it can circumvent maintenance mode, provide additional in-memory rate-limit counters, and trigger extra application startup effects and memory usage.
Users can upgrade to Wheels version 4.2.0, where this vulnerability is fixed. In production, the 'testcontext.cfm' include should be removed from 'public/Application.cfc' or the 'X-Wheels-Test-Context' header and 'WHEELS_TEST_CONTEXT' cookie, along with URLs containing '/wheels/app/tests' or '/wheels/core/tests', should be blocked at the web server or proxy.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wheels-dev/wheels/security/advisories/GHSA-xcj9-wm25-4cg4 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-348 | Use of Less Trusted Source | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wheels | >= 4.0.6, <= 4.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |