{"id":"CVE-2026-16487","kind":"vulnerability","aliases":["CVE-2026-16487"],"related":[],"title":"bootc: CVE-2026-16487 rejected, not a vulnerability per Red Hat","description":"Rejected reason: Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has already configured the host to follow. Requiring signatures is available through that policy and through bootc enforce-container-sigpolicy, which is off by default. Persistence of /var across bootc rollback is expected image-mode behavior.","summary":"CVE-2026-16487 was rejected by Red Hat Product Security, which determined it is not a vulnerability in bootc or containers-common. The record describes default image signature policy and expected /var persistence across rollback, and no exploitable flaw is reported.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bootc","image-mode","infrastructure","red-hat-enterprise-linux"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- No fix: the CVE is withdrawn and Red Hat says it is not a vulnerability.\n- For hardening anyway, review `/etc/containers/policy.json` and consider `bootc enforce-container-sigpolicy` to require image signatures.","status":"withdrawn","published_at":"2026-10-19T06:17:24+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:43+00:00","updated_at":"2026-10-25T05:12:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:12:43Z","model":"claude-haiku-5-5","output":{"fix":"- No fix: the CVE is withdrawn and Red Hat says it is not a vulnerability.\n- For hardening anyway, review `/etc/containers/policy.json` and consider `bootc enforce-container-sigpolicy` to require image signatures.","reach":"unknown","title":"bootc: CVE-2026-16487 rejected, not a vulnerability per Red Hat","impact":"low","summary":"CVE-2026-16487 was rejected by Red Hat Product Security, which determined it is not a vulnerability in bootc or containers-common. The record describes default image signature policy and expected /var persistence across rollback, and no exploitable flaw is reported.","category":"infrastructure","nicknames":[],"who_cares":["bootc","red-hat-enterprise-linux","image-mode"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000543,"input_tokens":3424,"output_tokens":401,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-16487':4A,14A,17A,30B '-2026':3A,13A,16A,29B '/etc/containers/policy.json':94C '/var':60B,154C 'abil':118C 'across':62B,155C 'administr':125C 'alreadi':127C 'avail':136C 'behavior':163C 'bootc':1A,18B,46B,85C,90C,142C,156C 'common':50B,89C 'configur':128C 'contain':49B,88C,145C 'containers-common':48B,87C 'cve':2A,12A,15A,28B 'default':54B,97C,151C 'describ':53B 'determin':39B,77C 'enforc':144C 'enforce-container-sigpolici':143C 'enterpris':26B 'expect':59B,159C 'explicit':104C 'exploit':66B 'fetch':91C 'flaw':67B 'follow':132C 'hat':11A,25B,35B,73C 'host':130C 'imag':20B,55B,92C,161C 'image-mod':19B,160C 'infrastructur':22B 'insecureacceptanyth':99C 'linux':27B 'mode':21B,162C 'mutabl':114C 'per':9A 'persist':61B,152C 'polici':57B,139C 'product':36B,74C 'publish':120C 'reason':71C 'record':52B 'red':10A,24B,34B,72C 'red-hat-enterprise-linux':23B 'refer':123C 'registri':101C 'registry.access.redhat.com':109C 'registry.redhat.io':107C 'reject':5A,32B,70C 'report':69B 'requir':106C,110C,116C,133C 'rollback':63B,157C 'secur':37B,75C 'ship':96C 'signatur':56B,105C,111C,134C 'sigpolici':146C 'tag':115C 'updat':112C 'vulner':8A,44B,83C 'without':102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16487","severity":null,"published_at":"2026-10-19T06:17:24+00:00","modified_at":"2026-10-21T07:17:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}