CVE-2026-16487: Insufficient Verification of Data Authenticity in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in the bootc component of Red Hat Enterprise Linux 10 when operating with the default containers signature policy. If a mutable image tag is upgraded automatically or manually, it may accept unsigned content from registries that fall through to insecureAcceptAnything. This insufficient verification of data authenticity enables an attacker with the ability to update the mutable image tag to execute arbitrary operating system content as the host root filesystem during system reboot.

Successful exploitation allows an attacker to execute arbitrary OS content with root privileges on the host by manipulating mutable image tags to include unsigned content. This compromises the integrity and security of the host system, potentially leading to full system compromise.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16487 for current remediation guidance. Until an official fix is available, avoid using mutable image tags that may fall back to insecureAcceptAnything or restrict registry sources to trusted and signed content.