Live › vulnerability › CVE-2026-16487
Go to dashboardCVE-2026-16487 was rejected by Red Hat Product Security, which determined it is not a vulnerability in bootc or containers-common. The record describes default image signature policy and expected /var persistence across rollback, and no exploitable flaw is reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
/etc/containers/policy.json and consider bootc enforce-container-sigpolicy to require image signatures.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Rejected reason: Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has already configured the host to follow. Requiring signatures is available through that policy and through bootc enforce-container-sigpolicy, which is off by default. Persistence of /var across bootc rollback is expected image-mode behavior.
This page as .md · .json · in your agent: get_signal("CVE-2026-16487")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.