Remote Code Execution Risk in Wheels Development Tools by Wheels
CVE-2026-111446

8.6HIGH

Key Information:

Vendor

Wheels

Status
Wheels
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111446?

Wheels versions 4.0.0 through 4.1.2 allow remote clients to access development tools without password protection when 'enablePublicComponent' is set to true, which is the default in the development environment. These versions lack local-access restrictions for the exposed tools, enabling potential attackers to retrieve sensitive application settings, environment details, and initiate test runs that could directly affect the live application database. Although version 4.1.2 introduced partial restrictions trusting client-supplied headers, it still failed to adequately verify the connected peer, posing a significant security risk. The issue has been addressed in version 4.2.0.

Affected Version(s)

Wheels 4.0.0 < 4.2.0

References

https://github.com/wheels-dev/wheels/security/advisories/...
vendor-advisory

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.