Summary
generated automatically from NVD databootc, when used with the default containers signature policy, can apply unsigned content during automatic or manual upgrades of a mutable image tag if the registry falls through to insecureAcceptAnything. An attacker able to update that tag could cause arbitrary OS content to become the host root filesystem on the next reboot. The issue is classed as CWE-345 (insufficient verification of data authenticity) and carries a CVSS v3.1 score of 8.1 (HIGH).
NVD description
A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot.
EPSS · FIRST.org
0.17%probability of exploitation in the next 30 days
Higher than 6% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 19 oct. 2026
- Updated
- 19 oct. 2026
- Status
- Received
- Source
- secalert@redhat.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-345
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.