CVE-2026-111446 Details
Description
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.
A vulnerability in Wheels versions 4.0.0 through 4.1.2 allows remote access to password-less development tools under '/wheels/*' when 'enablePublicComponent' is set to true, which is the default in development. Prior to version 4.1.2, these tools had no local-access restriction, and in 4.1.2, the restriction improperly trusts client-supplied headers without verifying the connecting peer. As a result, remote clients can access application settings, environment and datasource details, routes, and initiate test runs. Test runs that use the primary datasource can write to the application's real database. The vulnerability does not affect the separately protected migrator and CLI endpoints.
The vulnerability is fixed in Wheels version 4.2.0. For development servers, avoid running production servers in development mode, do not expose a development-mode server on a network interface, and block '/wheels/*' and '/wheels-docs' at the reverse proxy or web server. If using Docker, publish the port on '127.0.0.1' to prevent gateway address exposure.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wheels-dev/wheels/security/advisories/GHSA-6v6c-p375-vxw9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wheels | >= 4.0.0, <= 4.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |