High severity8.1NVD Advisory· Published Oct 19, 2026

CVE-2026-16487

Description

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Red Hat/bootcllm-create

Patches

Vulnerability mechanics

References

access.redhat.com/security/cve/CVE-2026-16487nvd
bugzilla.redhat.com/show_bug.cginvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000