CVE-2026-16460
A flaw was found in bootc and ostree
- Risk score
- 44/100
- CVSS
- 7.4 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leadin…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.4 high
References
Original description
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.
Last activity 19 Oct 2026. Patch Forecast updates every hour.