Key points
- CVE-2026-16487 affects Red Hat Enterprise Linux 8, 9, and 10.
- The flaw allows arbitrary OS content execution as root on reboot.
- No fix has been confirmed yet according to the provided material.
Red Hat Enterprise Linux 8, 9, and 10 users face a high-severity risk from a vulnerability in the bootc tool. The National Vulnerability Database lists CVE-2026-16487 with a CVSS score of 8.1. This flaw impacts systems using the default containers signature policy. Attackers can exploit this to run malicious code on the host root filesystem. The issue arises during automatic or manual upgrades of mutable image tags. No patch has been confirmed yet.
In plain English
The bootc tool manages operating system updates using container images. By default, it uses a signature policy that may accept content from certain registries without strict verification. If an attacker controls a mutable image tag, they can push unsigned or malicious content. When the system upgrades using this tag, it applies the insecure content. Upon reboot, the attacker’s code runs with root privileges. This effectively compromises the entire operating system.
The background
The vulnerability is classified under CWE-345, which relates to insufficient verification of data authenticity. It specifically affects Red Hat Enterprise Linux versions 8, 9, and 10. It also impacts Red Hat Hardened Images. The flaw exists when operating with the default containers signature policy. Registries that fall through to the insecureAcceptAnything setting are particularly at risk. This allows unsigned content to be applied during upgrade processes.
What changes now
Administrators must assess their exposure to mutable image tags. Systems using the default signature policy are vulnerable until a fix is available. Users should verify if their registries fall back to insecureAcceptAnything. Monitoring for unauthorized changes to image tags is critical. Until Red Hat releases an update, manual verification of image signatures is recommended. Teams should prepare to apply patches immediately upon release.
Who needs to act first
Teams usually prioritize systems exposed to external registries or those using mutable tags. Check whether your environments rely on default signature policies. Back up current configurations and image states before testing any workarounds. Roll out changes to a small group of non-production systems first. Verify that updates do not break existing functionality. Monitor logs for unexpected image pulls or signature failures. Reduce exposure by restricting access to mutable tags where possible.
What to do and how to stay safe: Red Hat
- Audit all systems running Red Hat Enterprise Linux 8, 9, or 10 for use of mutable image tags.
- Verify that container registries are not configured to fall back to insecureAcceptAnything.
- Implement strict signature verification policies for all bootc image upgrades.
- Monitor system logs for unauthorized image updates or signature verification failures.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Red Hat products are affected by CVE-2026-16487?
Red Hat Enterprise Linux 8, 9, and 10, as well as Red Hat Hardened Images, are affected.
What is the severity of this vulnerability?
The National Vulnerability Database rates it as HIGH with a CVSS score of 8.1.
Is there a patch available for this flaw?
No fix has been confirmed yet according to the provided source material.
