CVE-2026-110909
Received Received - Intake

Wheels CLI Local Server Spoofing Vulnerability

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: MITRE

Description
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-110909
EUVD
EUVD-2026-101817

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wheels Wheels CLI 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-923 The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Wheels CLI through 4.1.0 sends credentials and commands to a local server without verifying it belongs to the current project. This happens when multiple apps share ports or unrelated processes listen on probed ports. The CLI may expose reload passwords, send code for evaluation, or perform database operations on a different app's server. Exploitation requires a local process on a targeted port but no remote access.

Detection Guidance

Check if multiple Wheels applications are running on the same port (e.g., 8080) using commands like 'netstat -tuln | grep 8080' or 'ss -tuln | grep 8080'. Look for unexpected processes listening on probed ports. Verify CLI version with 'wheels version' to confirm if it is 4.1.0 or earlier.

  • Monitor network traffic for unauthorized HTTP requests to local ports using tools like Wireshark or tcpdump.
Impact Analysis

An attacker could intercept reload passwords, execute arbitrary code on your server, or modify database entries of another application running on your machine. This could lead to data breaches, unauthorized changes, or service disruption if you run multiple Wheels projects locally.

Mitigation Strategies

Upgrade Wheels CLI to version 4.1.1 or later immediately. Assign unique ports to each project to avoid conflicts. Stop other local servers before running state-changing CLI commands.

  • Update application templates manually if using older versions to ensure full security improvements.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110909. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart