---
id: CVE-2026-16487
title: >-
  bootc: containers-common: bootc: automatic updates can apply unsigned
  mutable-tag content under default containers policy (CVE-2026-16487)
summary: >-
  A flaw was found in bootc when operating with the default containers signature
  policy. Automatic or manual upgrades of a mutable image tag may apply unsigned
  content for registries that fall through to insecureAcceptAnything, allowing
  an a…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe: CWE-345
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - hardened_images
published: '2026-10-10'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T06:20:13+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16487.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16487.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-16487'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2503686'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-16487'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-16487'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00173
epssPercentile: 0.06308
ingestedAt: '2026-10-19T07:09:59.601Z'
---

## Overview

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot.

## Vendor advisories

- **Red Hat VEX** · Important · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16487.json)

**bootc: containers-common: bootc: automatic updates can apply unsigned mutable-tag content under default containers policy** — rated Important by Red Hat. Released 2026-10-10, updated 2026-10-21.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.