ostree vulnerabilities

CVEs whose affected-version data names the ostree package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-16460High· 7.4

yesterday

Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive pol…

▾ TwilightRed Hat · bootcEPSS 0.08%via CVEORG