CVE-2026-16487

Low risk· EPSS 6%

Published: 19/10/2026(UTC)Updated: 21/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The report was rejected by Red Hat Product Security, which determined it is not a vulnerability in bootc or containers-common. The default /etc/containers/policy.json allows insecureAcceptAnything for registries without an explicit signature requirement, while registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has configured, and signature enforcement can be enabled via policy or bootc enforce-container-sigpolicy (off by default).

Risk Assessment

Red Hat does not consider this a vulnerability, so there is no direct risk from this entry. Organizations using registries without signature requirements should still consciously assess whether the default insecureAcceptAnything policy meets their security requirements.

Recommendation

Do not treat this as a vulnerability to patch. Consider enabling signature enforcement via /etc/containers/policy.json or bootc enforce-container-sigpolicy if image signing is required.

Other vulnerabilities in bootc

CVE-2026-16460High
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

Original NVD description (English source)

Rejected reason: Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has already configured the host to follow. Requiring signatures is available through that policy and through bootc enforce-container-sigpolicy, which is off by default. Persistence of /var across bootc rollback is expected image-mode behavior.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS