CVE-2026-16487— Bootc: containers-common: bootc: automatic updates can apply unsigned mutable-tag content under default containers policy
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 中使用默认的容器签名策略时，发现了一个安全漏洞。当对可变镜像标签（mutable image tag）执行自动或手动升级时，若目标注册表匹配到 策略（即未配置严格签名验证），则可能加载未经签名的内容。这允许能够更新该镜像标签的攻击者，在系统重启后以主机根文件系统的 root 权限执行任意操作系统内容。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16487
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bootc: containers-common: bootc: automatic updates can apply unsigned mutable-tag content under default containers policy
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-16487
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16487
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16487 (2)
Same Patch Batch · Red Hat · 2026-10-19 · 10 CVEs total
| CVE-2026-112261 | 7.8 HIGH | Gimp: gimp: use-after-free in xcf loader via prop_selected_path |
| CVE-2026-112258 | 7.8 HIGH | Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels |
| CVE-2026-112257 | 7.8 HIGH | Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033) |
| CVE-2026-103314 | 7.4 HIGH | Stackrox: stackrox: saml response replay allows multiple central authentication tokens |
| CVE-2026-16460 | 7.4 HIGH | Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signatur |
| CVE-2026-112260 | 7.1 HIGH | Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing |
| CVE-2026-112214 | 6.5 MEDIUM | Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in |
| CVE-2026-112210 | 6.0 MEDIUM | Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service |
| CVE-2026-112259 | 5.5 MEDIUM | Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-112261
Gimp: gimp: use-after-free in xcf loader via prop_selected_p -
CVE-2026-112258
Gimp: gimp: use-after-free in xcf loader via prop_linked and -
CVE-2026-112257
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail l -
CVE-2026-112260
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasi -
CVE-2026-112259
Gimp: gimp: null pointer dereference in swatchbooker (sbz) p
Same vendor: Red Hat
-
CVE-2026-112261
Gimp: gimp: use-after-free in xcf loader via prop_selected_p -
CVE-2026-112258
Gimp: gimp: use-after-free in xcf loader via prop_linked and -
CVE-2026-112257
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail l -
CVE-2026-112260
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasi -
CVE-2026-112259
Gimp: gimp: null pointer dereference in swatchbooker (sbz) p
Same weakness: CWE-345
-
CVE-2026-112265
LangBot through 4.11.0 Missing Lark/Feishu Webhook Authentic -
CVE-2026-112161
Lack of integrity checks in Mobatek’s MobaXterm -
CVE-2026-16460
Bootc: ostree: bootc/ostree: staged deployments not revalida -
CVE-2026-111392
SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /g -
CVE-2026-55103
Discourse ActivityPub: Fix inbound actor validation and appl
V. Comments for CVE-2026-16487
No comments yet