Live › vulnerability › CVE-2026-111450
Go to dashboardWheels through 4.1.1 takes its default production error-email address from the Host header of the request that starts the application. An attacker who triggers a cold start with a chosen Host can redirect later error emails to an address they control, exposing error and request metadata, and possibly configuration secrets or session data on some engines.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications running Wheels 4.1.1 or earlier that send production error emails, have no explicit error-email recipient configured, and have a mail server configured that accepts arbitrary Host values. Applications with an explicit recipient set, or with no mail server, are not exposed through this path.
No product ranges from the sources yet.
4.1.1 or earlier is affected)4.1.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can direct later error emails to an address under their control for that application's lifetime. Emails disclose error and request metadata; on engines/versions where scope dumps render, they may also disclose configuration secrets and other users' session/cookie data. On the Lucee 7 engine, scope dumps fail to render, limiting disclosure to header fields. This is fixed in 4.1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-111450")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.