CVE-2026-16487

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16487", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "REJECTED", "assignerShortName": "redhat", "dateReserved": "2026-07-21T15:40:31.772Z", "datePublished": "2026-10-19T05:27:30.898Z", "dateUpdated": "2026-10-21T06:20:13.903Z", "dateRejected": "2026-10-21T06:20:13.903Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has already configured the host to follow. Requiring signatures is available through that policy and through bootc enforce-container-sigpolicy, which is off by default. Persistence of /var across bootc rollback is expected image-mode behavior."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-21T06:20:13.903Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has already configured the host to follow. Requiring signatures is available through that policy and through bootc enforce-container-sigpolicy, which is off by default. Persistence of /var across bootc rollback is expected image-mode behavior."}], "id": "CVE-2026-16487", "lastModified": "2026-10-21T07:17:17.703", "metrics": {}, "published": "2026-10-19T06:17:24.203", "references": [], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Rejected"}

{"acknowledgement": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue.", "bugzilla": {"description": "bootc: containers-common: bootc: automatic updates can apply unsigned mutable-tag content under default containers policy", "id": "2503686", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503686"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-345", "details": ["A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot."], "mitigation": {"lang": "en:us", "value": "Pin bootc updates to image digests, or configure /etc/containers/policy.json to reject unsigned content by default and allow only explicitly trusted signed scopes. Until policy is hardened, disable automatic updates (bootc-fetch-apply-updates.timer). After a suspected malicious image, do not rely on bootc rollback alone: audit and remediate persistent /var (including /var/roothome), then re-enroll to a trusted signed image."}, "name": "CVE-2026-16487", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "bootc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "containers-common", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:rhel8/containers-common", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "bootc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "containers-common", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "bootc", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "containers-common", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "containers-common", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-16487\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-16487"], "statement": "This issue affects Red Hat Enterprise Linux image-mode (bootc) hosts that are enrolled to a mutable image tag and use a containers signature policy that permits unsigned content for that registry (including the default insecureAcceptAnything fall-through for registries without explicit signed scopes). Hosts that only pull from registries with enforced signature policy, or that pin updates to digests / signed identity, are not affected by this specific chain. Persistence of /var across bootc rollback is expected platform behavior and is not treated as a separate flaw; it is called out because it can retain attacker state after a naive rollback.\nRed Hat OpenShift Container Platform 4 is not affected. RHCOS node OS updates are applied by the Machine Config Operator during the OpenShift cluster update, using digest-pinned container images from the OpenShift release payload, not via bootc automatic updates of a mutable image tag.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}]}, "product": "bootc", "vendor": "bootc"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat Enterprise Linux 10", "source": "cna", "vendor": "Red Hat"}, "product": "enterprise_linux", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Red Hat Hardened Images", "source": "cna", "vendor": "Red Hat"}, "product": "hardened_images", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Red Hat OpenShift Container Platform 4", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_container_platform", "vendor": "redhat"}], "created": "2026-10-19T06:30:06.374693+00:00", "updated": "2026-10-21T17:01:23.377567+00:00", "vendors": ["bootc", "bootc$PRODUCT$bootc", "redhat", "redhat$PRODUCT$enterprise_linux", "redhat$PRODUCT$hardened_images", "redhat$PRODUCT$openshift_container_platform"]}