CVE-2026-16487

bootc: containers-common: bootc: automatic updates can apply unsigned mutable-tag content under default containers policy

Loading…

Severity

Important

Red Hat Product Security

8.1

CVSS 3.1

Review impact separately from score.

Published · October 10, 2026

Updated · November 4, 2026

Description

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot.

Statement

Status: Rejected

Reason: bootc follows the shipped containers policy (insecureAcceptAnything by default), so this is the documented trust model and not a product defect.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-345 · Insufficient Verification of Data Authenticity