CVE-2026-111446

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111446

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111446.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111446

Aliases

GHSA-6v6c-p375-vxw9

Published

2026-10-16T03:37:32Z

Modified

2026-10-17T02:48:01Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator

Summary

[none]

Details

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.

Database specific

{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111446.json"
}

References

Affected packages

Git / github.com/wheels-dev/wheels

Affected ranges

Type

GIT

Repo

https://github.com/wheels-dev/wheels

Events

Introduced

3914c9080bb33276b1bdbde10a84323f4041200c

Fixed

0e589def0922a3f0643cfd17c4ea5fdd8c41b9a6

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.2.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111446.json"