CVE-2026-16487

Full vulnerability record from the local CVENow database.

Description

Rejected reason: Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has already configured the host to follow. Requiring signatures is available through that policy and through bootc enforce-container-sigpolicy, which is off by default. Persistence of /var across bootc rollback is expected image-mode behavior.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Rejected

Source identifier

[email protected]

Published

2026-10-19 06:17:24.203000

Last modified

2026-10-21 07:17:17.703000

View original CVE JSON

{
  "id": "CVE-2026-16487",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-19T06:17:24.203",
  "lastModified": "2026-10-21T07:17:17.703",
  "vulnStatus": "Rejected",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has already configured the host to follow. Requiring signatures is available through that policy and through bootc enforce-container-sigpolicy, which is off by default. Persistence of /var across bootc rollback is expected image-mode behavior."
    }
  ],
  "metrics": {},
  "references": []
}