{"id":"CVE-2026-111443","kind":"vulnerability","aliases":["CVE-2026-111443"],"related":[],"title":"Wheels: unauthenticated header or cookie switches requests into test context","description":"Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug escalation. It can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. This is fixed in 4.2.0.","summary":"Wheels 4.0.6 through 4.1.2 lets any unauthenticated client route a request into a separate test application context by sending an X-Wheels-Test-Context header, a WHEELS_TEST_CONTEXT cookie, or a test-runner path in the URL, including in production. The alternate context shares the same configuration, datasource and debug settings, so the impact is bypassing runtime-only maintenance mode, getting a second set of in-memory rate-limit counters, and extra startup work and memory use rather than data access.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coldfusion","lucee","runtime","self-hosted","wheels"],"not_affected_if":["wheels-4.2.0-or-later","wheels-below-4.0.6"],"how_to_check":"- Check the installed Wheels version in the application's dependency or box configuration; affected range is `4.0.6` through `4.1.2`.\n- Send a request with `X-Wheels-Test-Context: x` to a production route and see whether behavior changes (unknown if the sources give a safe test method).","fix":"- Upgrade Wheels to `4.2.0`, which fixes this issue.","status":"open","published_at":"2026-10-16T04:18:30+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:59:13+00:00","updated_at":"2026-10-25T03:59:13+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:59:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Wheels to `4.2.0`, which fixes this issue.","reach":"internet","title":"Wheels: unauthenticated header or cookie switches requests into test context","impact":"low","summary":"Wheels 4.0.6 through 4.1.2 lets any unauthenticated client route a request into a separate test application context by sending an X-Wheels-Test-Context header, a WHEELS_TEST_CONTEXT cookie, or a test-runner path in the URL, including in production. The alternate context shares the same configuration, datasource and debug settings, so the impact is bypassing runtime-only maintenance mode, getting a second set of in-memory rate-limit counters, and extra startup work and memory use rather than data access.","category":"runtime","nicknames":[],"who_cares":["wheels","coldfusion","lucee","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Maintenance mode bypassed and extra rate-limit counters or startup load.","analyst_note":"","how_to_check":"- Check the installed Wheels version in the application's dependency or box configuration; affected range is `4.0.6` through `4.1.2`.\n- Send a request with `X-Wheels-Test-Context: x` to a production route and see whether behavior changes (unknown if the sources give a safe test method).","needs_analyst":false,"not_affected_if":["wheels-below-4.0.6","wheels-4.2.0-or-later"],"who_is_affected":"Applications running Wheels versions 4.0.6 through 4.1.2 in production are exposed, since the switch works from any unauthenticated request including in production. The sources do not describe a data-access path, and the flaw does not escalate privileges, so teams on other Wheels versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":3444,"output_tokens":642,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111443':13A,16A '-2026':12A,15A '4.0.6':25B,112C '4.1.2':27B,114C '4.2.0':220C 'access':110B 'addit':207C 'altern':68B,164C 'anywher':155C 'applic':39B,126C,165C,209C 'application-startup':208C 'authent':179C 'bypass':82B,180C,186C 'client':31B,118C 'coldfus':17B 'configur':73B,169C 'context':10A,40B,48B,53B,69B,127C,138C,143C 'cooki':5A,54B,144C 'counter':99B,204C 'cve':11A,14A 'data':109B 'data/debug':182C 'datasourc':74B,171C 'debug':76B,173C 'effect':212C 'enabl':189C 'environ':170C 'escal':183C 'even':159C 'extra':101B 'fix':218C 'get':88B 'header':3A,49B,139C 'host':22B 'impact':80B 'in-memori':93B,198C 'includ':64B,128C,149C 'let':28B,115C 'limit':98B,203C 'luce':18B 'mainten':86B,187C 'memori':95B,105B,200C,214C 'mode':87B,188C 'path':60B,154C 'product':66B,130C 'provid':193C 'queri':161C 'rate':97B,202C 'rate-limit':96B,201C 'rather':107B 'request':7A,34B,121C 'rout':32B 'runner':59B,153C 'runtim':19B,84B,192C 'runtime-on':83B 'second':90B,195C 'self':21B 'self-host':20B 'send':42B 'separ':37B,124C 'set':77B,91B,174C,196C 'share':70B 'side':211C 'startup':102B,210C 'string':162C 'suppli':132C 'switch':6A,119C 'test':9A,38B,47B,52B,58B,125C,137C,142C,152C 'test-runn':57B,151C 'trigger':206C 'unauthent':2A,30B,117C 'url':63B,158C 'use':106B,166C,215C 'valu':147C 'wheel':1A,23B,24B,46B,51B,111C,136C,141C 'work':103B 'x':45B,135C 'x-wheels-test-context':44B,134C","nicknames":[],"mitigations":[],"who_affected":"Applications running Wheels versions 4.0.6 through 4.1.2 in production are exposed, since the switch works from any unauthenticated request including in production. The sources do not describe a data-access path, and the flaw does not escalate privileges, so teams on other Wheels versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T04:18:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111443","severity":null,"published_at":"2026-10-16T04:18:30+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}