Bug 2503167 (CVE-2026-16460)

Summary: CVE-2026-16460 bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2555446    
Bug Blocks:    
Deadline: 2026-10-18   

Description OSIDB Bzimport 2026-07-21 11:47:12 UTC 
A flaw was found in bootc and ostree on RHEL image-mode hosts. Container signature policy in /etc/containers/policy.json is enforced on image pull and import paths, but already-staged ostree deployments are finalized and booted without revalidation against the current policy. If unsigned OS content was staged while policy was permissive, an administrator who later hardens policy to reject unsigned images can still boot that staged content on the next ordinary reboot or via bootc upgrade --from-downloaded apply paths. This can result in execution of unsigned attacker-controlled OS content as the host root filesystem after believed remediation.