---
id: "CVE-2026-111443"
kind: "vulnerability"
aliases: ["CVE-2026-111443"]
title: "Wheels: unauthenticated header or cookie switches requests into test context"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["coldfusion", "lucee", "runtime", "self-hosted", "wheels"]
not_affected_if: ["wheels-4.2.0-or-later", "wheels-below-4.0.6"]
published_at: "2026-10-16T04:18:30+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:59:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111443", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Wheels: unauthenticated header or cookie switches requests into test context

Wheels 4.0.6 through 4.1.2 lets any unauthenticated client route a request into a separate test application context by sending an X-Wheels-Test-Context header, a WHEELS_TEST_CONTEXT cookie, or a test-runner path in the URL, including in production. The alternate context shares the same configuration, datasource and debug settings, so the impact is bypassing runtime-only maintenance mode, getting a second set of in-memory rate-limit counters, and extra startup work and memory use rather than data access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Wheels version in the application's dependency or box configuration; affected range is `4.0.6` through `4.1.2`.
- Send a request with `X-Wheels-Test-Context: x` to a production route and see whether behavior changes (unknown if the sources give a safe test method).

## Fix

- Upgrade Wheels to `4.2.0`, which fixes this issue.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111443

## From the sources

Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug escalation. It can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. This is fixed in 4.2.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_