CVE-2026-111443: Wheels test context access control bypass

CVE-2026-111443 · Severity: medium · CVSS 6.5 · Published 2026-10-16

Wheels is a ColdFusion web framework. An unauthenticated attacker can switch a request to a separate test application context in production by sending a specially crafted header, cookie, or URL, allowing them to bypass maintenance mode, double in-memory rate limits, and trigger repeated application startup side effects that consume memory and resources.

Technologies: Wheels. Vendors: Wheels.

Quick answers

Is CVE-2026-111443 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111443 being exploited in the wild.
How severe is CVE-2026-111443?
Medium severity, with a CVSS score of 6.5, published 16 October 2026.
Which products and versions are affected?
Wheels 4.0.6 through 4.1.2.
Is there a fix for CVE-2026-111443?
Yes: fixed in 4.2.0. Until then: Remove the testcontext.cfm include from public/Application.cfc in production, or block the X-Wheels-Test-Context header and WHEELS_TEST_CONTEXT cookie and URLs containing /wheels/app/tests or /wheels/core/tests at the web server or proxy level. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111443 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-111443?
Check whether you run Wheels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 4.2.0

Remove the testcontext.cfm include from public/Application.cfc in production, or block the X-Wheels-Test-Context header and WHEELS_TEST_CONTEXT cookie and URLs containing /wheels/app/tests or /wheels/core/tests at the web server or proxy level.

Technical details

The vulnerability exists in vendor/wheels/events/testcontext.cfm, which switches requests to an isolated test application context based on an X-Wheels-Test-Context header, WHEELS_TEST_CONTEXT cookie, or test-runner paths in the URL, with no environment check and no authentication required. The request switching happens before routing, allowing exploitation in production. An attacker gains the ability to bypass runtime-only maintenance mode, circumvent rate limits by using separate in-memory counters, and force onApplicationStart execution on demand, causing side effects and memory exhaustion.

Affected products

  • Wheels Wheels 4.0.6 through 4.1.2

Timeline

  • 2026-10-12: disclosed
  • 2026-10-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.