EUVD-2026-45422
GHSA-fgcw-c69x-x32q
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only vector (AV:A), authenticated low-privilege access required (PR:L), and race condition timing dependency (AC:H) yield no confidentiality or availability impact, only low integrity.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increment_hostname of the file src/ralph/assets/models/assets.py of the component Hostname Allocation Handler. Executing a manipulation of the argument counter can lead to race condition. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Race condition in Allegro Ralph's hostname allocation handler allows adjacent, low-privileged attackers to corrupt hostname assignment logic, producing duplicate or incorrect hostname entries. The flaw resides in the AssetLastHostname.increment_hostname function within src/ralph/assets/models/assets.py, where concurrent manipulation of the counter argument creates a time-of-check/time-of-use window. The project maintainers were notified via an issue report but have not yet responded, leaving no available patch; a proof-of-concept exploit has been publicly disclosed on GitHub. No public exploit identified at time of analysis beyond the PoC, and KEV status is not confirmed.
Technical ContextAI
Ralph is an open-source Data Center Infrastructure Management (DCIM) and asset management platform developed by Allegro, the Polish e-commerce company. The vulnerable component is the Hostname Allocation Handler, specifically the AssetLastHostname.increment_hostname function in the Python file src/ralph/assets/models/assets.py. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization - Race Condition) identifies the root cause: the counter variable governing hostname suffix increments is accessed by multiple concurrent threads or processes without adequate locking, allowing interleaved execution paths to produce inconsistent counter state. The CPE string cpe:2.3:a:n/a:allegro:*:*:*:*:*:*:*:* covers all versions up to and including commit bcf65b994ef29fb3fc2e10b660e6288723d5209e. The tags include 'Information Disclosure' alongside 'Race Condition', suggesting the corrupted hostname state may expose internal naming conventions or asset enumeration data beyond just integrity corruption.
RemediationAI
No vendor-released patch identified at time of analysis - the project maintainers have not yet responded to the disclosure. As a primary compensating control, administrators should restrict access to Ralph's hostname allocation functionality to the minimum set of authenticated users, reducing the pool of potential concurrent actors who could trigger the race. Network-level controls should enforce strict adjacency boundaries so that only trusted internal segments can reach the Ralph service, limiting the effective attack surface per the AV:A vector. Reviewing and enforcing application-level rate limiting or serialization on hostname allocation requests (e.g., via Django's database-level select_for_update() locking or Redis-based distributed locks around the increment_hostname call) would directly neutralize the race window and is the recommended interim mitigation. Monitor the GitHub issue at https://github.com/allegro/ralph/issues/3950 for an upstream fix. Operators may also consider pinning to the last known-good commit prior to bcf65b994ef29fb3fc2e10b660e6288723d5209e, though no clean prior boundary has been confirmed.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today