# CVE-2026-16460: Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization Status: published. Published: 2026-10-19. Updated: 2026-11-04. A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot. ## Remediation - workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to revalidate container image signatures against active container signature policy before finalizing or booting staged ostree deployments in bootc and ostree: upgrade to the fixed Bootc/Ostree/Rpm Ostree/Rust Zincati builds, which revalidates container image signatures against the active container signature policy in /etc/containers/policy.json before finalizing or booting already-staged ostree deployments, closing all 2 injection vectors (host reboot into pending staged deployment, bootc upgrade --from-downloaded deployment application). Until patched, this is only a concern on Linux systems using bootc or ostree, including RHEL image-mode hosts — Non-Linux platforms are unaffected — so Clear all existing staged ostree deployments immediately after hardening /etc/containers/policy.json and ensure unsigned container images are never staged. As a compensating measure, Run SELinux in enforcing mode to confine processes running from finalized deployments to defined domains and Deploy IMA/EVM appraisal to verify executable file signatures at runtime and block untrusted binaries. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing signature revalidation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-712 Container Image Signing and Provenance Verification (Cosign/Sigstore) (high) (source: CNA: redhat) ## Affected products and versions - Red Hat / Red Hat Enterprise Linux 10 (bootc): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10 (ostree): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10 (rpm-ostree): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8 (ostree): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 9 (bootc): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 9 (ostree): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 9 (rpm-ostree): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Hardened Images (bootc): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Hardened Images (ostree): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 4 (ostree): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 5 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 5 (ostree): Version range not reported. Source: CNA: redhat ## Severity and prioritization - CVSS 3.1: 7.4 (high); CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; source: CNA: redhat - CISA KEV: No listing in collected sources - EPSS: 0.10% as of 2026-11-03; percentile 0.75% - SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP - Weaknesses: CWE-345 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://access.redhat.com/security/cve/CVE-2026-16460 (CNA: redhat; vdb-entry, x_refsource_REDHAT) - https://bugzilla.redhat.com/show_bug.cgi?id=2503167 (CNA: redhat; issue-tracking, x_refsource_REDHAT) ## Provenance - CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-16460; retrieved 2026-11-04; source updated 2026-11-04 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-16460; retrieved 2026-11-04; source updated Not reported Revision: e145ecc64042c9678c8078a6ef938a31449f8cbb0dce24fa5035e438be100133 Canonical: https://y2.dev/cve/CVE-2026-16460 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.