{"id":"CVE-2026-16487","revision":"1ef2cdd04c3a48a08570827c250d14c3","records":[{"revision":"1ef2cdd04c3a48a08570827c250d14c3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-16487","aliases":[],"title":"Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit…","description":"Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has already configured the host to follow. Requiring signatures is available through that policy and through bootc enforce-container-sigpolicy, which is off by default. Persistence of /var across bootc rollback is expected image-mode behavior.","state":1,"publishedAt":"2026-10-19T05:27:30.898+00:00","modifiedAt":"2026-10-21T06:20:13.903+00:00","affected":[],"metrics":[],"references":[],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-16487","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-16487","identifiers":["CVE-2026-16487"]},"retained":false,"historicalAffected":[]}],"coverage":[]}