CVE-2026-111446
Received Received - Intake

Wheels Framework Development Tools Exposure

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111446
EUVD
EUVD-2026-102608

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wheels Wheels 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Wheels framework versions 4.0.0 through 4.1.2. When the public component is enabled (default in development), remote clients can access development tools under the /wheels/* path. These tools expose sensitive information like environment settings, datasource details, and routes. They also allow initiating test runs that may write to the application database if tests use the primary datasource. The issue stems from improper validation of client-supplied headers, enabling remote exploitation. It is fixed in version 4.2.0.

Detection Guidance

Check if your Wheels framework version is between 4.0.0 and 4.1.2. Use curl to test access to /wheels/* paths. Example: curl http://localhost:port/wheels/routes or curl http://localhost:port/wheels/environment. If responses contain sensitive data like routes or environment settings, the system is vulnerable.

Impact Analysis

An attacker could access sensitive application data, including environment settings and database details. They might also execute test runs that alter or corrupt the application database if tests interact with the primary datasource. This could lead to data breaches, unauthorized modifications, or service disruption. The impact is higher if the application is exposed in development mode on a network interface.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, non-compliance penalties, and reputational damage due to exposure of confidential information.

Mitigation Strategies

Upgrade Wheels to version 4.2.0 or later. If upgrading is not possible, bind the development server to localhost only. Block /wheels/* paths at your reverse proxy. Avoid running production servers in development mode. For Docker, block requests from the Docker gateway address unless explicitly allowed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111446. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart