CVE-2026-16460— Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 和 中发现了一个漏洞：已分阶段（staged）的部署在最终化时，未根据当前的容器签名策略重新验证部署的容器镜像。因此，在先前宽松的签名策略下分阶段的未签名操作系统内容，即使后续策略已加强以拒绝未签名镜像，仍可能在重启后保持可引导状态，从而导致主机在重启时面临完全被攻陷的风险。
Possible ATT&CK Techniques 2 AI
T1547.001 · Registry Run Keys / Startup Folder T1548.001 · Setuid and SetgidAffected Version Matrix 11
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
unaffected |
any |
unaffected | ||
any |
unaffected | ||
| Red Hat | Red Hat Enterprise Linux 8 | any |
unaffected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
unaffected |
any |
unaffected | ||
any |
unaffected | ||
| Red Hat | Red Hat Hardened Images | any |
affected |
any |
affected | ||
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
unaffected |
any |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16460
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-16460
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16460
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16460 (2)
Same Patch Batch · Red Hat · 2026-10-19 · 10 CVEs total
| CVE-2026-16487 | 8.1 HIGH | Bootc: containers-common: bootc: automatic updates can apply unsigned mutable-tag content |
| CVE-2026-112261 | 7.8 HIGH | Gimp: gimp: use-after-free in xcf loader via prop_selected_path |
| CVE-2026-112258 | 7.8 HIGH | Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels |
| CVE-2026-112257 | 7.8 HIGH | Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033) |
| CVE-2026-103314 | 7.4 HIGH | Stackrox: stackrox: saml response replay allows multiple central authentication tokens |
| CVE-2026-112260 | 7.1 HIGH | Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing |
| CVE-2026-112214 | 6.5 MEDIUM | Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in |
| CVE-2026-112210 | 6.0 MEDIUM | Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service |
| CVE-2026-112259 | 5.5 MEDIUM | Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-112261
Gimp: gimp: use-after-free in xcf loader via prop_selected_p -
CVE-2026-112258
Gimp: gimp: use-after-free in xcf loader via prop_linked and -
CVE-2026-112257
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail l -
CVE-2026-112260
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasi -
CVE-2026-112259
Gimp: gimp: null pointer dereference in swatchbooker (sbz) p
Same vendor: Red Hat
-
CVE-2026-112261
Gimp: gimp: use-after-free in xcf loader via prop_selected_p -
CVE-2026-112258
Gimp: gimp: use-after-free in xcf loader via prop_linked and -
CVE-2026-112257
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail l -
CVE-2026-112260
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasi -
CVE-2026-112259
Gimp: gimp: null pointer dereference in swatchbooker (sbz) p
Same weakness: CWE-345
-
CVE-2026-112265
LangBot through 4.11.0 Missing Lark/Feishu Webhook Authentic -
CVE-2026-112161
Lack of integrity checks in Mobatek’s MobaXterm -
CVE-2026-16487
Bootc: containers-common: bootc: automatic updates can apply -
CVE-2026-111392
SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /g -
CVE-2026-55103
Discourse ActivityPub: Fix inbound actor validation and appl
V. Comments for CVE-2026-16460
No comments yet