Live › vulnerability › CVE-2026-111443
Go to dashboardWheels 4.0.6 through 4.1.2 lets any unauthenticated client route a request into a separate test application context by sending an X-Wheels-Test-Context header, a WHEELS_TEST_CONTEXT cookie, or a test-runner path in the URL, including in production. The alternate context shares the same configuration, datasource and debug settings, so the impact is bypassing runtime-only maintenance mode, getting a second set of in-memory rate-limit counters, and extra startup work and memory use rather than data access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications running Wheels versions 4.0.6 through 4.1.2 in production are exposed, since the switch works from any unauthenticated request including in production. The sources do not describe a data-access path, and the flaw does not escalate privileges, so teams on other Wheels versions can skip it.
No product ranges from the sources yet.
4.0.6 through 4.1.2.X-Wheels-Test-Context: x to a production route and see whether behavior changes (unknown if the sources give a safe test method).4.2.0, which fixes this issue.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug escalation. It can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. This is fixed in 4.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-111443")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.