External risk intelligence

Wheels SQL Injection Vulnerability via Dynamic Finders

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-110911

The vulnerability exists in a web application framework (Wheels) within database query and lookup methods commonly used to handle request data. Because these functions are frequently used to process inputs from web-facing endpoints such as login forms, search bars, and API inputs, the vulnerable code is commonly exposed to public internet traffic.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Wheels framework that could allow unauthorized access to sensitive data when parsing user-supplied values in database lookups. This could potentially impact authentication, password resets, or token lookups if specific functions are used with untrusted input. The primary concern is to confirm if your applications utilize the affected components with external data.

SQL injection risk in database lookups.
Impacts authentication and data access.
Confirm usage with external data.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted input through web requests that are processed by the application. This input can be interpreted as SQL commands, allowing the attacker to manipulate database queries. If successful, this could lead to unauthorized access to sensitive information or even compromise the application's integrity.

No authentication is required.
Vulnerable database query functions are called.
Risk of unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

SQL injection vulnerabilities in dynamic finders and query builder methods could allow attackers to manipulate database lookups. This may expose authentication credentials, password-reset tokens, and other sensitive data when unauthenticated user-supplied values are parsed as SQL. Numeric-column values are not affected.

Authentication and token data at risk.
Unquoted user input parsed as SQL.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation of this SQL injection vulnerability likely falls to application owners and platform teams responsible for the web framework and its database interactions. The first practical step is to identify all instances of the affected framework, confirm their exposure to external requests, and assess their business criticality to prioritize response efforts.

Application owners should lead the investigation.
Verify all database query inputs.
Plan remediation during scheduled maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Wheels framework?

Wheels is a web application framework used by developers to build and manage database-driven websites. It includes built-in tools for performing common database tasks, such as looking up users by email, retrieving records by unique keys, and validating data uniqueness. These tools are designed to simplify how an application interacts with its backend database when handling incoming information.

What does CWE-89 mean for CVE-2026-110911?

CWE-89 identifies this vulnerability as an SQL injection. In this specific case, the framework's internal parser mistakenly interprets certain characters in user-provided text as SQL commands rather than plain data. Because the system treats these characters as instructions, an attacker can manipulate the underlying database queries to access or alter data that they should not be able to reach.

Do I need to worry about numeric data inputs?

No, numeric-column values are not affected by this vulnerability. The risk is limited to specific methods that process string-based inputs, such as those used for email addresses or key-based lookups. Furthermore, simply passing data through these functions is not enough; the bug is only triggered when the framework incorrectly parses specially crafted string input as part of a database command.

How does Halo Surface Signal assess this risk?

Halo Surface Signal flags this as a 'Likely' risk because Wheels is a web framework. Since developers frequently connect these specific database query and lookup methods directly to web-facing endpoints like login forms or search bars, the vulnerable code often resides in places that are reachable from the public internet, increasing the likelihood that an attacker could attempt to submit malicious input.

How should I respond to this vulnerability?

The most important first step is to identify where your applications use the affected Wheels methods to process data provided by users. Once you have a list of these locations, evaluate whether they are exposed to external requests. If you find these patterns in your code, coordinate with your development team to plan an update to version 4.1.2, which contains the fix for these parsing errors.

References

github.com/wheels-dev/wheels/security/advisories/GHSA-96rm-h22v-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.