{"id":"CVE-2026-16460","kind":"vulnerability","aliases":["CVE-2026-16460"],"related":[],"title":"bootc and ostree: staged deployments skip signature re-check before reboot","description":"A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.","summary":"bootc and ostree finalize already-staged OS deployments without rechecking the container image against the current signature policy. Unsigned OS content staged under an older, permissive policy can still boot after the policy is tightened, which gives an attacker full host compromise on reboot.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bootc","fixed":[],"affected":"unknown","ecosystem":"vendor"},{"name":"ostree","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["bootc","image-mode","infrastructure","linux","ostree","rhel","self-hosted"],"not_affected_if":["no-permissive-policy-history","no-staged-deployments","policy-hardened-before-first-stage"],"how_to_check":"On bootc/ostree hosts run 'bootc status' (and 'ostree admin status') and look for a staged deployment; if one exists and was pulled while /etc/containers/policy.json allowed unsigned images, treat as exposed. Compare installed bootc/ostree package versions against Red Hat's errata once published (none yet).","fix":"No fixed version published yet (unknown; Red Hat says upgrade to fixed bootc/ostree builds when released). Interim: after tightening /etc/containers/policy.json, discard any staged deployment (re-run 'bootc upgrade' so it restages under the new policy, or 'ostree admin undeploy' the pending one) before rebooting, and never stage unsigned images.","status":"open","published_at":"2026-10-19T07:16:31+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:27:19+00:00","updated_at":"2026-10-25T03:42:29+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:27:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"bootc and ostree: staged deployments skip signature re-check before reboot","impact":"high","summary":"bootc and ostree finalize already-staged OS deployments without rechecking the container image against the current signature policy. Unsigned OS content staged under an older, permissive policy can still boot after the policy is tightened, which gives an attacker full host compromise on reboot.","category":"infrastructure","nicknames":[],"who_cares":["bootc","ostree","linux","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unsigned OS content boots and gives full host compromise","analyst_note":"Find the fixed bootc and ostree versions and the advisory at the NVD link; confirm whether the attack needs local access or an update step.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-permissive-policy-history","no-staged-deployments"],"who_is_affected":"Hosts that run bootc or ostree-based OS images (such as bootc-managed systems) that stage updates with a container signature policy and that were ever set to a permissive policy before being hardened. Systems that never staged unsigned images under a permissive policy are less exposed. The sources do not name the fixed versions.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000566,"input_tokens":3296,"output_tokens":473,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed bootc and ostree versions and the advisory at the NVD link; confirm whether the attack needs local access or an update step.","search":"'-16460':15A,18A '-2026':14A,17A 'alreadi':37B,86C 'already-stag':36B,85C 'attack':71B 'boot':62B 'bootabl':115C 'bootc':1A,19A,21B,32B,82C 'check':10A 'compromis':74B,128C 'contain':44B,96C,101C 'content':53B,106C 'current':48B,100C 'cve':13A,16A 'deploy':5A,40B,88C,94C 'final':35B,90C 'flaw':78C 'found':80C 'full':72B,126C 'give':69B 'harden':119C 'host':31B,73B,127C 'imag':23B,45B,97C,123C 'image-mod':22B 'infrastructur':25B 'lead':124C 'linux':26B 'mode':24B 'older':57B 'os':39B,52B,105C 'ostre':3A,27B,34B,84C 'ostree':20A 'permiss':58B,111C 'polici':50B,59B,65B,103C,112C,117C 'prior':110C 're':9A 're-check':8A 'reboot':12A,76B,130C 'recheck':42B 'reject':121C 'remain':114C 'revalid':92C 'rhel':28B 'self':30B 'self-host':29B 'signatur':7A,49B,102C 'skip':6A 'stage':4A,38B,54B,87C,107C 'still':61B 'tighten':67B 'unsign':51B,104C,122C 'without':41B,91C","nicknames":[],"mitigations":[],"who_affected":"Image-mode Linux hosts running bootc or ostree (including Red Hat Hardened Images and OpenShift nodes) that staged an OS image while the container signature policy was permissive and later tightened it. Exploitation needs local access or the ability to get unsigned content staged (e.g. a pushed mutable tag pulled by an upgrade); the stale staged deployment then boots on reboot. Hosts that never staged unsigned content, or clear staged deployments after hardening policy, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16460","severity":null,"published_at":"2026-10-19T07:16:31+00:00","modified_at":"2026-10-21T19:17:02+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16460:776","url":null,"severity":null,"published_at":"2026-10-25T03:42:29+00:00","modified_at":"2026-10-25T03:42:29+00:00","first_seen_at":"2026-10-25T03:42:29+00:00","fetched_at":"2026-10-25T03:42:29+00:00","note":"Read Red Hat CVE page (CNA): local, high complexity, no fixed versions or errata published; RHEL 8/10 listed not affected per aggregators, Hardened Images/OpenShift affected. No exploitation or PoC seen. Upstream bootc fix commit not found."}],"documents":[{"id":3296,"url":"https://access.redhat.com/security/cve/CVE-2026-16460","title":"Red Hat CVE-2026-16460","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3297,"url":"https://bootc.dev/bootc/bootc-security.7.html","title":"bootc security and threat model","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}