CVE-2026-16487

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot.

An attacker could supply an unsigned image and gain code execution as root on the host, leading to full system compromise.

Update bootc to a version containing the fix. Avoid using mutable image tags and ensure the signature policy rejects unsigned images.