Executive Summary

A vulnerability, CVE-2026-16460, with a CVSS score of 7.4, was found in bootc and ostree. This flaw allows already-staged deployments to be finalized without revalidating the deployment's container image against the current containers signature policy. As a result, unsigned OS content staged under a prior permissive policy can remain bootable after the policy is hardened to reject unsigned images, potentially leading to full host compromise on reboot. This affects Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images.

Technical Analysis

The vulnerability class of CVE-2026-16460 is related to improper validation of container images during the deployment finalization process. The attack vector involves local access to the system where an already-staged deployment can be finalized. The root cause of this vulnerability is the lack of revalidation of the deployment's container image against the current containers signature policy when finalizing already-staged deployments.

How It Gets Exploited

An attacker with local access to a system that has an already-staged deployment can exploit this vulnerability. The attacker would need to have staged unsigned OS content under a prior permissive policy. When the policy is later hardened to reject unsigned images, the previously staged unsigned content can remain bootable. Upon reboot, this unsigned content can lead to a full host compromise. The technical exploitation involves the deployment process not revalidating the container image signatures, allowing malicious content to be executed.

Impact Assessment

Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images are affected by this vulnerability. Specifically, the packages bootc, ostree, and rpm-ostree are impacted. An attacker could achieve full host compromise by exploiting this vulnerability, leading to confidentiality, integrity, and availability impacts. The CVSS score of 7.4 indicates a high severity level.

Recommended Actions

To mitigate this vulnerability, update the affected systems by applying the necessary patches or updates. Specifically:
  • Update Red Hat Enterprise Linux 8, 9, 10 to the latest version of ostree.
  • Update Red Hat Enterprise Linux 9, 10 to the latest version of bootc.
  • Update Red Hat Enterprise Linux 8, 9 to the latest version of rpm-ostree.
  • Ensure that Red Hat Hardened Images are updated to use patched versions of bootc and ostree.
Implement a strict container image signature validation policy to prevent the use of unsigned images. Monitor for and restrict the use of unsigned OS content in deployments.

Sources

  • National Vulnerability Database (NVD)