Testing Context Vulnerability in Wheels by Wheels Dev

CVE-2026-111443

What is CVE-2026-111443?

A vulnerability in Wheels versions 4.0.6 through 4.1.2 allows an unauthenticated client to alter the request context, enabling the usage of a test application environment in production. By injecting an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie, or incorporating a test-runner path into the URL, attackers can access the same configuration, environment, and data sources as in the main application. While this does not result in authentication bypass or escalation of sensitive information, it permits bypassing of runtime maintenance mode, creates alternative in-memory rate-limit counters, and initiates additional application startup behaviors. This issue has been resolved in version 4.2.0.

References