CVE-2026-16487: bootc Policy Configuration Issue (Rejected)

CVE-2026-16487 Overview

CVE-2026-16487 is a rejected CVE entry. Red Hat Product Security evaluated the report and determined that the described behavior does not constitute a vulnerability in bootc or containers-common. The report concerned how bootc fetches container images using the policy defined in /etc/containers/policy.json and the persistence of /var across bootc rollback operations.

Critical Impact
No security impact. Red Hat classified the reported behavior as expected image-mode functionality rather than a vulnerability. No patch is required.

Affected Products

bootc (no vulnerability confirmed)
containers-common (no vulnerability confirmed)
Red Hat image-mode systems using /etc/containers/policy.json

Discovery Timeline

2026-10-19 - CVE-2026-16487 published to NVD
2026-10-21 - Entry last modified in NVD database and marked as rejected

Technical Details for CVE-2026-16487

Vulnerability Analysis

The reported concern focused on three behaviors in bootc and containers-common. First, bootc fetches container images governed by /etc/containers/policy.json. Second, the shipped default policy uses insecureAcceptAnything for registries without an explicit signature requirement. Third, data under /var persists across bootc rollback operations.

Red Hat Product Security reviewed each item and concluded none represent a security defect. The shipped policy already enforces signatures for registry.redhat.io and registry.access.redhat.com. Administrators retain the ability to require signatures on additional registries through policy.json or by enabling bootc enforce-container-sigpolicy.

Root Cause

No root cause exists because no vulnerability was confirmed. The behaviors described reflect documented design choices. Updating a mutable tag requires publish access to a reference the administrator has already configured the host to follow, which is standard container trust model behavior. Persistence of /var across rollback is intentional image-mode behavior that preserves application state separate from the base image.

Attack Vector

No exploitable attack vector was identified. An administrator who wants stronger supply-chain guarantees can configure signature enforcement through /etc/containers/policy.json or enable bootc enforce-container-sigpolicy, which ships disabled by default. Modifying image content still requires legitimate publish access to a registry reference the host operator has chosen to trust.

Detection Methods for CVE-2026-16487

Indicators of Compromise

No indicators of compromise apply because CVE-2026-16487 was rejected and no exploit exists.
Review of /etc/containers/policy.json can confirm whether registries beyond Red Hat defaults enforce signatures.

Detection Strategies

Audit bootc host configurations to confirm the signature policy aligns with organizational trust requirements.
Verify whether bootc enforce-container-sigpolicy is enabled on hosts that require strict supply-chain validation.
Track container image pull events to confirm images originate from approved registries.

Monitoring Recommendations

Monitor changes to /etc/containers/policy.json and alert on transitions to insecureAcceptAnything for sensitive registries.
Record bootc upgrade and bootc rollback events for configuration drift reviews.
Log registry authentication activity for the references configured in each host's trust policy.

How to Mitigate CVE-2026-16487

Immediate Actions Required

No remediation is required because Red Hat rejected the vulnerability report.
Confirm your bootc fleet uses signature enforcement for every registry your organization treats as a trust boundary.
Review administrator access controls for registries referenced in /etc/containers/policy.json.

Patch Information

No patch is required or available. Red Hat Product Security determined that the reported behavior is not a vulnerability in bootc or containers-common. Administrators seeking stronger controls should rely on existing configuration options rather than wait for a fix.

Workarounds

Edit /etc/containers/policy.json to require signedBy entries for every registry that must enforce image signing.
Enable bootc enforce-container-sigpolicy on hosts that require container signature policy enforcement at the bootc layer.
Restrict registry publish permissions so only authorized maintainers can update mutable tags that hosts follow.
Treat /var persistence as intended behavior and store ephemeral workload data accordingly.

bash

# Configuration example
# Review current bootc image policy
cat /etc/containers/policy.json

# Enable bootc container signature policy enforcement
sudo bootc enforce-container-sigpolicy