CVE-2026-111443
Deferred Deferred - Pending Action

Wheels Framework Test Context Misconfiguration in 4.0.6-4.1.2

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description
Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug escalation. It can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. This is fixed in 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111443
EUVD
EUVD-2026-102605

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wheels Wheels 4.0.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Wheels versions 4.0.6 through 4.1.2 allows an unauthenticated client to switch a request into a separate test application context by providing specific headers, cookies, or URL paths. The test context uses the same production configuration and settings, enabling actions like bypassing maintenance mode, duplicating rate limits, and triggering additional startup processes. It is fixed in version 4.2.0.

Detection Guidance

Check for requests containing X-Wheels-Test-Context header, WHEELS_TEST_CONTEXT cookie, or URLs with /wheels/app/tests or /wheels/core/tests. Inspect web server logs for these patterns.

Impact Analysis

An attacker could exploit this to bypass maintenance mode, manipulate rate limiting, or cause increased memory usage by triggering application startup side effects. While it does not allow data access or authentication bypass, it can disrupt service availability and integrity.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to production environments through test application contexts. It may bypass maintenance mode and trigger additional application startup effects, which could lead to unintended data exposure or system modifications. The lack of proper isolation between test and production contexts raises concerns about data integrity and confidentiality.

Mitigation Strategies

Upgrade Wheels to version 4.2.0 or later. As a temporary workaround, remove testcontext.cfm from public/Application.cfc in production or block the specific headers and URLs at the web server or proxy level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111443. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart