CVE-2026-111443: Medium severity CFWheels Wheels vulnerability
Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELSTESTCONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug escalation. It can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. This is fixed in 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wheelsto a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Wheels 4.0.6 through 4.1.2 are affected, including production deployments. No authentication is required to trigger the alternate test application context.
What can an attacker do through this issue?
An attacker can cause requests to run in a separate application context, bypassing maintenance mode if it was enabled only at runtime and using a separate set of in-memory rate-limit counters. They can also trigger additional application-startup side effects and memory consumption.
Does this expose debug information or bypass application authentication?
No. The alternate application uses the same configuration, environment, datasource, and debug settings, so this is not an authentication bypass or a data/debug escalation.
How can exploitation be triggered and detected?
The alternate context can be selected with an X-Wheels-Test-Context header, a WHEELS_TEST_CONTEXT cookie, or a test-runner path anywhere in the URL, including the query string. Review request logs for these headers, cookies, and test-runner path values.
What is the remediation?
Upgrade to Wheels 4.2.0, which fixes the issue. The provided information does not identify an interim configuration workaround.