TI-2026-74578 Aliases CVE-2026-110909

Wheels CLI does not verify the local server it sends requests to

LOW 22CWE-923Published 2026-10-15 · Updated 2026-10-20

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Wheels CLI before 4.1.1 does not verify that the local development server answering its HTTP requests belongs to the current project (CWE-923). A local process listening on a targeted port can receive the project's reload password and submitted code when a developer runs wheels reload or wheels console. Other commands can also make unintended state-changing requests to a different local application's server and database.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down. Other commands can perform unintended state-changing operations against a different local application's server and database. Exploitation requires a process listening on a targeted local port and the developer running an affected command. This is fixed in 4.1.1, including changes to the CLI and application template.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00134 2nd percentileScored 2026-11-07

Fix Fixed Wheels CLI (Wheels): 4.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Wheels	Wheels CLI	before 4.1.1	4.1.1	Patch available	CNA

Wheels CLI VendorWheels Affected before 4.1.1 Fixed in 4.1.1 Patch available CNA

Remediation

Update Wheels CLI to version 4.1.1, which includes changes to the CLI and the application template.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Wheels CLI (Wheels) Fixed in 4.1.1

Timeline

2026-10-15 Threatist record created from CVE-2026-110909
2026-10-20 CISA SSVC decision points changed

References

Advisory 1

https://github.com/wheels-dev/wheels/security/advisories/GHSA-x3cm-2j3q-jgg4

TI-2026-74581 SQL injection in Wheels query builder and dynamic finders CVSS 3.1CRITICAL 9.8
TI-2026-75147 Wheels exposes unprotected development tools to remote clients CVSS 3.1HIGH 8.6
TI-2026-75145 SQL injection in Wheels on MySQL and MariaDB via unbound literals CVSS 3.1CRITICAL 9.8
TI-2026-75148 Wheels nested form updates can modify another parent's records CVSS 3.1HIGH 8.1
TI-2026-75146 Wheels findByKey() and exists(key=) ignore scope conditions CVSS 3.1HIGH 8.1
TI-2026-75152 Command injection and unsafe file handling in Wheels CLI CVSS 3.1HIGH 7.8

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences