CVE-2026-16460

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject...

CVE-2026-16460

A flaw exists in bootc and ostree where already-staged deployments are finalized without revalidating the container image against the current container signature policy . This allows unsigned OS content, staged under a previous permissive policy, to remain bootable even after the policy is harden...

CVE-2026-16460

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject...

CVE-2026-16460 Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject...

CVE-2026-16460 Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject...

EUVD-2026-104093

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject...

CVE-2026-16487

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS...

CVE-2026-16487

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS...

CVE-2026-16487 Bootc: containers-common: bootc: automatic updates can apply unsigned mutable-tag content under default containers policy

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS...

EUVD-2026-104078

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS...

CVE-2026-16487

A flaw in bootc (part of containers-common ) allows automatic or manual upgrades of mutable image tags to apply unsigned content when using the default containers signature policy. This occurs because certain registries fall through to the insecureAcceptAnything policy. An attacker capable of upd...

PT-2026-117234

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS...

Critical: Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images

Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image. Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal as a bootable...

CVE-2026-54422

A flaw was found in OpenStack ironic-python-agent's bootc container deployment support. During bootc image deployment, the OCI registry pull secret was exposed to tenant-controlled container code running with host PID namespace visibility. A malicious bootc container image could read the operator...

CVE-2026-54422: Insufficiently Protected Credentials

In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...

CVE-2026-41898 vulnerabilities

Vulnerabilities for packages: sentry-cli, rustup, rpm-sequoia, sccache, rustls-openssl-client, sqlx, ztunnel-fips, guestproxyagent, sdp-k8s-injector, valkey-ldap, bootc, deno, komodo, typst, vector...

CVE-2026-41677 vulnerabilities

Vulnerabilities for packages: sentry-cli, rustup, rpm-sequoia, sccache, rustls-openssl-client, sqlx, ztunnel-fips, guestproxyagent, sdp-k8s-injector, valkey-ldap, bootc, deno, komodo, typst, vector...

CVE-2026-41678 vulnerabilities

Vulnerabilities for packages: sentry-cli, rustup, rpm-sequoia, sccache, rustls-openssl-client, sqlx, ztunnel-fips, guestproxyagent, sdp-k8s-injector, valkey-ldap, bootc, deno, komodo, typst, vector...

GHSA-8C75-8MHR-P7R9 vulnerabilities

Vulnerabilities for packages: sentry-cli, rustup, rpm-sequoia, sccache, rustls-openssl-client, sqlx, ztunnel-fips, guestproxyagent, sdp-k8s-injector, valkey-ldap, bootc, deno, komodo, typst, vector...

GHSA-GHM9-CR32-G9QJ vulnerabilities

Vulnerabilities for packages: sentry-cli, rustup, rpm-sequoia, sccache, rustls-openssl-client, sqlx, ztunnel-fips, guestproxyagent, sdp-k8s-injector, valkey-ldap, bootc, deno, komodo, typst, vector...