CVE-2026-16460CWE-345

CVE-2026-16460

High · published October 19, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00078 · 0.1th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-10-19T11:16Z
References (2)
https://access.redhat.com/security/cve/CVE-2026-16460 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2503167 · [email protected]
EPSS history
Timeline
  • 20 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 19 OCT 06:40Z
    Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
    cvelistv5
  • 19 OCT 06:40Z
    Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
    cvelistv5