HIGH 7.4 NVD

CVE-2026-16460

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current contain

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

References

https://access.redhat.com/security/cve/CVE-2026-16460
https://bugzilla.redhat.com/show_bug.cgi?id=2503167

Published: 2026-10-19 · Source: NVD · Feed updated: 2026-10-19

This high severity vulnerability with a CVSS score of 7.4 was published on 2026-10-19 via NVD.

vulnfeed aggregates 17512 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.