CVE-2026-111446: High severity CFWheels Wheels vulnerability
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/ to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wheelsto a version that resolves this vulnerability.Fixed in 4.2.0 - Configuration
Set enablePublicComponent to false to prevent remote exposure of development tools under /wheels/*.
Wheels enablePublicComponent = false
Event History
Frequently Asked Questions
Which deployments are exposed to remote access?
Deployments with enablePublicComponent=true are exposed; this setting is enabled by default in development. The affected password-less development tools are available under /wheels/* to remote clients.
What can an unauthenticated remote attacker do?
A remote client can retrieve application settings, environment and datasource details, and route information, and can start test runs. If tests use the primary datasource, those runs can write to the production application database.
Are all Wheels administrative endpoints affected?
No. The separately protected migrator and CLI endpoints are not affected.
Does version 4.1.2 fully prevent remote exploitation?
No. Although 4.1.2 adds a local-access restriction, it trusts client-supplied headers without validating the connecting peer. The issue is fixed in 4.2.0.