CVE-2026-111449

Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.

• CWE-362

• https://github.com/wheels-dev/wheels/security/advisories/GHSA-8r22-vwcc-v55m

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111443Wheels 4.0.6 through 4.1.2 lets an unauthenticated client sw…6.5
• CVE-2026-111444Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB w…9.8
• CVE-2026-111445Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming sc…8.1
• CVE-2026-111446Wheels 4.0.0 through 4.1.2 exposes password-less development…8.6
• CVE-2026-111447Wheels 1.1 through 4.1.2 resolves nestedProperties() records…8.1
• CVE-2026-111448Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons…3.7
• CVE-2026-11145Race in Geolocation in Google Chrome on Android prior to 149…5.3
• CVE-2026-111450Wheels through 4.1.1 derives its default production error-em…5.9
• CVE-2026-111451Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or e…7.8
• CVE-2026-111458The fanx_fingerprint function in ssl/sslxprint.c of ssldump …6.8
• CVE-2026-11146Insufficient validation of untrusted input in Chromoting in …9.6
• CVE-2026-11147Use after free in WebML in Google Chrome on Windows prior to…8.8