Low severity · published Jul 19, 2026
CVE-2026-16211
allegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race condition
2.6
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increment_hostname of the file src/ralph/assets/models/assets.py of the component Hostname Allocation Handler. Executing a manipulation of the argument counter can lead to race condition. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Adjacent
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
allegro · Allegro
bcf65b994ef29fb3fc2e10b660e6288723d5209e · source: vendor
Affected product
AL
allegro
Allegro
More from allegro
8.1
CVE-2021-43978
Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials
7.8
CVE-2021-42110
An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1