CVE-2026-16487
NONE—CVSS v3
—CVSS v2
0.17%
EPSS (exploit probability)
—CWE
Description
Rejected reason: Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has already configured the host to follow. Requiring signatures is available through that policy and through bootc enforce-container-sigpolicy, which is off by default. Persistence of /var across bootc rollback is expected image-mode behavior.
Affected routers (0)
No routers currently mapped to this CVE in our database.