What happened
A vulnerability identified as CVE-2026-16487 has been reported in the bootc component used within certain Red Hat Enterprise Linux environments and Hardened Images. The flaw occurs when the system operates with the default containers signature policy. Specifically, during the upgrade process of a mutable image tag—either automatically or manually—unsigned content can be applied if the registry configuration permits fall-through to insecureAcceptAnything. This situation can lead to an attacker who controls the image tag successfully executing arbitrary operating system content during the reboot process. The malicious content could then run with root privileges, resulting in potential compromise of the affected deployment's core operating environment. The vulnerability's severity is rated high, with an CVSS base score of 8.1. Exploiting this flaw does not require prior access or user interaction, and it can be conducted remotely by attacking an exposed service directly. The nature of the attack exploits the image upgrade process, making network exposure, proper access controls, and segmentation paramount for mitigation.
Who is affected
Organisations running Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, or Hardened Images that utilise the default containers signature policy and perform image upgrades are potentially affected. Any deployment where image tags are mutable and may be upgraded without verification are at risk if the registry falls through to insecureAcceptAnything. The flaw's exploitation does not depend on user interaction and can be initiated remotely over a network, posing a significant threat to affected environments.
Recommended actions
- Implement network access controls and segmentation to limit exposure of registry services and container upgrade pathways from untrusted sources.
- Ensure that registry configurations do not allow fall-through to insecureAcceptAnything or equivalent settings that permit unsigned content.
- Review and strengthen overall security controls surrounding container image management and updates, especially in environments where tags are mutable.
- Monitor for updates from Red Hat regarding patches or configuration recommendations addressing this vulnerability.
