Live › vulnerability › CVE-2026-111446
Go to dashboardWheels 4.0.0 through 4.1.2 serves password-less development tools under /wheels/* to remote clients when enablePublicComponent is true, which is the development default. A remote client can read application settings, environment and datasource details, and routes, and start test runs that can write to the real database when tests use the primary datasource.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications running Wheels 4.0.0 through 4.1.2 with enablePublicComponent set to true, which is the default in development. Exposure is greatest where a development or staging build is reachable from the internet, and where application tests use the primary datasource. Production deployments with the setting false, and the separately protected migrator and CLI endpoints, are not affected.
No product ranges from the sources yet.
4.0.0 through 4.1.2.enablePublicComponent in the Wheels settings; true exposes the tools./wheels/ on a deployed host from outside the network and see whether the tools respond.4.2.0.enablePublicComponent to false and block /wheels/* at the edge.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-111446")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.