CVE-2026-16211
LOWallegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race condition
Title source: cnaDescription
A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increment_hostname of the file src/ralph/assets/models/assets.py of the component Hostname Allocation Handler. Executing a manipulation of the argument counter can lead to race condition. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
References (5)
Core 5
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-380027 | allegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race condition
https://vuldb.com/vuln/380027
Signature, Permissions Required signature
permissions-required
VDB-380027 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/380027/cti
Third Party Advisory third-party-advisory
CVE-2026-16211 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-16211
Third Party Advisory third-party-advisory
Submit #857935 | allegro ralph bcf65b994ef29fb3fc2e10b660e6288723d5209e CWE-362 Concurrent Execution using Shared Resource with Improper
https://vuldb.com/submit/857935
Exploit exploit
issue-tracking
https://github.com/allegro/ralph/issues/3950
Scores
CVSS v3
2.6
EPSS
0.0016
EPSS Percentile
5.3%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-362
Status
published
Products (1)
None/allegro
bcf65b994ef29fb3fc2e10b660e6288723d5209e
Published
Jul 19, 2026
Tracked Since
Jul 19, 2026