CVE-2026-111450

🗓️ 16 Oct 2026 03:49:20Reported by mitreType

cve🔗 web.nvd.nist.gov👁 76 Views🌐 WEB

Wheels Host header flaw allows an attacker to redirect error emails to a controlled address.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-111450	16 Oct 202603:58	–	circl
CNNVD	WHEELS.DEV: Vulnerabilities in Wheel Trust Management	15 Oct 202616:00	–	cnnvd
Cvelist	CVE-2026-111450	16 Oct 202603:49	–	cvelist
EUVD	EUVD-2026-102603	16 Oct 202603:49	–	euvd
Mend	CVE-2026-111450	16 Oct 202603:49	–	mend
Microsoft CVE	Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can direct later error emails to an address under their control for that application's lifetime. Emails disclose error and request metadata; on engines/versions where scope dumps render, they may also disclose configuration secrets and other users' session/cookie data. On the Lucee 7 engine, scope dumps fail to render, limiting disclosure to header fields. This is fixed in 4.1.2.	21 Oct 202608:02	–	mscve
NVD	CVE-2026-111450	16 Oct 202604:18	–	nvd
osv_azl	AZL-109532 CVE-2026-111450 affecting package python-wheel 0.43.0-2	16 Oct 202604:18	–	osv_azl
Positive Technologies	PT-2026-115413	16 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-111450: Use of Less Trusted Source	16 Oct 202600:00	–	rapid7

[
  {
    "defaultStatus": "unaffected",
    "product": "Wheels",
    "repo": "https://github.com/wheels-dev/wheels",
    "vendor": "Wheels",
    "versions": [
      {
        "lessThan": "4.1.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/wheels-dev/wheels/security/advisories/GHSA-8gcv-3v9h-7gj2

Parameter	Position	Path	Description	CWE
Host	header	/	The application derives its default production error-email address from the Host header of the request that starts the application. An attacker can provide a malicious Host header to redirect error emails to an address under their control.	CWE-348

19 Oct 2026 19:17Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.9

EPSS0.00136

SSVC

CWE-348