CVE-2026-16460

HighCVSS 7.4

Published: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Summary

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

Risk Assessment

An attacker could use unsigned images to gain persistent access and compromise the host on reboot.

Recommendation

Update bootc and ostree to versions containing the fix. After hardening the signature policy, revalidate all staged deployments.

Other vulnerabilities in bootc

CVE-2026-16487High
A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS