CVE-2026-111450
Received Received - Intake

Wheels Cold Start Email Header Injection

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description
Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can direct later error emails to an address under their control for that application's lifetime. Emails disclose error and request metadata; on engines/versions where scope dumps render, they may also disclose configuration secrets and other users' session/cookie data. On the Lucee 7 engine, scope dumps fail to render, limiting disclosure to header fields. This is fixed in 4.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111450
EUVD
EUVD-2026-102603

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wheels Wheels 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Wheels framework versions 4.1.1 and earlier. It allows an attacker to redirect production error emails to their own address by manipulating the Host header in the first request after a cold start (like a deploy or restart). These emails may contain sensitive data such as error details, request metadata, and session information.

Detection Guidance

To detect this vulnerability, monitor for unexpected error emails sent to addresses not configured in your system. Check web server logs for requests with manipulated Host headers during cold starts. Inspect Wheels framework logs for error emails containing sensitive data like session cookies or configuration secrets.

Impact Analysis

An attacker could gain access to sensitive information like error logs, request headers, session cookies, and configuration secrets. This could lead to data breaches, unauthorized access, or further exploitation of the system if credentials or other secrets are exposed in error emails.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, fines, or reputational damage if such breaches occur due to non-compliance with these regulations.

Mitigation Strategies

Upgrade Wheels to version 4.1.2 or later. Explicitly configure error email recipients in the Wheels settings to override the default Host header-derived address. Configure your web server to reject invalid or attacker-controlled Host headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111450. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart