CVE-2026-16487

CVE-2026-16487CVE-2026-16487

Description

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot.

Scoring

CVSS 8.1 ()
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Last modified2026-10-19
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.