CVE-2026-111449: Race Condition
Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wheelsto a version that resolves this vulnerability.Fixed in 4.1.2 - Configuration
Keep allowIPBasedDebugAccess disabled to prevent detailed exception disclosure.
Wheels allowIPBasedDebugAccess = false
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Wheels 3.0.0 through 4.1.1 are exposed only if allowIPBasedDebugAccess=true is enabled. That setting is disabled by default, so deployments that have not enabled it are not affected by the described condition.
What must happen for an attacker to obtain exception details?
An allowed administrator request must change the shared error/debug-display settings at the same time an unauthorized client triggers an error. The unauthorized request may then receive detailed exception information, including tag context, a serialized exception, and sensitive data contained in those details.
Does this give an attacker access to developer tools in production?
No. The race condition does not bypass the production gate that protects developer tools.
What is the remediation?
Upgrade to Wheels 4.1.2, which fixes the issue. If upgrading is not immediately possible, disable allowIPBasedDebugAccess to remove the condition described.