CVE-2026-16460

A flaw exists in bootc and ostree where already-staged deployments are finalized without revalidating the container image against the current container signature policy . This allows unsigned OS content, staged under a previous permissive policy, to remain bootable even after the policy is harden...

CVE-2026-16460 Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject...