bootc/ostree CVE-2026-16460

Exploitation requires an image-mode bootc/ostree host where a deployment was staged while the container signature policy was permissive enough to accept unsigned (or non-conforming) images, followed by hardening of that policy to reject unsigned images before the staged deployment is finalized and the host reboots; the staged unsigned content is then finalized and booted without being revalidated against the new, stricter policy. Limiting factors that reduce real-world risk: local access is needed (AV:L), the attack is high-complexity (AC:H) because it depends on the specific timing/ordering of staging relative to the policy change, it applies only to bootc/ostree image-mode deployments (RHEL 8/9/10 image mode, OpenShift Container Platform 4, Red Hat Hardened Images), and realistically requires the ability to stage deployments, i.e. operator/local privilege despite the vendor's PR:N rating.

This is a signature-verification bypass (CWE-345) in bootc/ostree where a deployment staged while the container signature policy was permissive is finalized on reboot without re-checking it against the now-hardened policy, allowing unsigned OS content to boot and yield full host compromise (C:H/I:H/A:H). The CVSS 3.1 vector (7.4, AV:L/AC:H/PR:N/UI:N) describes a local, high-complexity, scope-unchanged issue, and the high complexity plus local vector already temper the otherwise severe impact. There is a notable internal tension: the vector lists PR:N, yet the described scenario requires an actor to have already staged a deployment and depends on a specific administrative sequence (permissive policy → stage unsigned content → harden policy → reboot), which in practice implies local privileged/operational access rather than a true zero-privilege attack - verify the privilege assumption with Red Hat. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis; combined with AC:H and the required policy-transition timing, real-world exploitation is a conditional/operational race rather than a mass-exploitable remote bug. Net: a legitimately high-impact integrity flaw worth patching on image-mode hosts, but its real priority is bounded by local access, high attack complexity, and the specific precondition that unsigned content was staged under a prior permissive policy.

An operator (or an actor with local access to the host's staging workflow) stages an unsigned or improperly signed bootc/ostree container image while the container signature policy still permits unsigned content. The signature policy is subsequently hardened to reject unsigned images, but because the already-staged deployment is finalized without revalidation, the unsigned OS content remains bootable and executes on the next reboot, giving the attacker control of the booted host. No public exploit code is identified at time of analysis, and the high attack complexity reflects the required ordering of staging and policy changes.