CVE-2026-16487
Received Received - Intake

Bootc Mutable Image Signature Policy Bypass

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: redhat-SADP

Description
A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-16487
EUVD
EUVD-2026-104078

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 8 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Hardened Images *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16487 is a flaw in Red Hat's bootc tool when using the default containers signature policy. It allows attackers to execute arbitrary OS content as the host root filesystem on reboot by exploiting mutable image tags that fall through to insecureAcceptAnything, enabling unsigned content to be applied during upgrades.

Detection Guidance

Check if your system is enrolled to mutable image tags with permissive signature policies by reviewing bootc configuration files and registry settings. Inspect /etc/containers/policy.json for insecureAcceptAnything or permissive policies. Verify if automatic updates are enabled and if the enrolled image tag is mutable.

Impact Analysis

An attacker who can update a mutable image tag may cause your system to reboot into attacker-controlled OS content running with root privileges. Persistent /var data may retain attacker state even after rollback, allowing continued compromise.

Compliance Impact

This vulnerability could lead to unauthorized root access and persistent compromise, violating confidentiality and integrity requirements in GDPR and HIPAA. Unauthorized code execution may result in data breaches or unauthorized data access.

Mitigation Strategies

Pin updates to image digests in your bootc configuration to prevent mutable tag exploitation. Harden the containers policy to reject unsigned content by updating /etc/containers/policy.json. Disable automatic updates until the policy is hardened. Audit persistent /var for signs of compromise before re-enrolling to a trusted signed image.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16487. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart