CVE-2026-110909

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.

• CWE-923

• https://github.com/wheels-dev/wheels/security/advisories/GHSA-x3cm-2j3q-jgg4

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110891Missing Authorization vulnerability in WordLift Srl WordLift…5.4
• CVE-2026-1109A vulnerability was detected in cijliu librtsp up to 2ec1a81…7.8
• CVE-2026-11090Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7…6.5
• CVE-2026-110904ApostropheCMS before 4.33.0 allows authentication bypass for…5.3
• CVE-2026-110907Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.3…7.5
• CVE-2026-110908Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and so…8.8
• CVE-2026-11091Inappropriate implementation in Dawn in Google Chrome prior …8.8
• CVE-2026-110911Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-…9.8
• CVE-2026-110912In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input…7.1
• CVE-2026-110913Memory corruption in DOM in Google Chrome prior to 155.0.805…8.8
• CVE-2026-110914Memory corruption in Workers in Google Chrome prior to 155.0…8.8
• CVE-2026-110915Use after free in Compositing in Google Chrome prior to 155.…8.8