Your message dated Tue, 18 Aug 2026 21:47:22 +0000
with message-id <[email protected]>
and subject line Bug#1144214: fixed in ironic 1:29.0.5-0+deb13u3
has caused the Debian Bug report #1144214,
regarding API ramdisk endpoints require network-level access controls
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144214: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144214
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: ironic
Version: 1:29.0.5-0+deb13u2
Severity: important
Tags: patch security
X-Debbugs-Cc: Debian Security Team <[email protected]>
As per upstream announce at:
https://wiki.openstack.org/wiki/OSSN/OSSN-0106
Ironic API ramdisk endpoints require network-level access controls
Summary:
The Ironic Bare Metal API combines authenticated endpoints for client use with
unauthenticated endpoints for coordination with the Ironic Python Agent
ramdisk into a single API service. Depending on the deployment architecture,
this can expose security risks if the unauthenticated endpoints are reachable
from untrusted networks.
Affected Services / Software:
ironic: >=6.2.0
/v1/lookup and /v1/heartbeat: API version 1.22 (Newton, ironic 6.2.0)
/v1/continue_inspection: API version 1.84 (2024.2)
Discussion:
Ironic has three endpoints which allow unauthenticated access:
GET /v1/lookup
POST /v1/heartbeat/{node_ident}
POST /v1/continue_inspection
These endpoints are a documented aspect of Ironic's architecture and are
covered in the Ironic security guide. They already have significant security
controls to mitigate risk, such as bootstrapping into credentials via the
agent token mechanism (mandatory since the Victoria release), callback URL
validation, and defaulting to limiting access to nodes whose provisioning
state requires use of them.
Regardless of authentication methodology, operators in multi-tenant or
untrusted environments should deploy a split-horizon API configuration where
the unauthenticated endpoints are not reachable from public or tenant networks.
Using Keystone does not eliminate the need for this network-level separation.
Previously, Ironic only provided policy-based overrides to disable these
endpoints, which required Keystone and left operators using HTTP basic auth or
noauth without an equivalent control. A new ``[api]enable_ramdisk_endpoints``
configuration option is being added to allow any operator, regardless of
authentication methodology, to disable these endpoints on a per-service basis.
For full details on the security model around these endpoints, refer to the
Ironic security guide:
https://docs.openstack.org/ironic/latest/admin/security.html
Recommended Actions:
Operators using Ironic in a multi-tenant or untrusted environment should
configure the Ironic API so that the unauthenticated endpoints are only
accessible from networks where the Ironic Python Agent ramdisk operates. This
can be achieved in several ways depending on infrastructure setup:
1. Run separate public-facing and ramdisk-facing Ironic API services.
WARNING: Disabling the ramdisk endpoints without maintaining a separate API
service that the Ironic Python Agent can reach will break all deployment,
cleaning, inspection, rescue, and servicing workflows. These endpoints must
remain available to the ramdisk on at least one API service.
On the public-facing service, disable the ramdisk endpoints using one of the
following methods:
Set ``[api]enable_ramdisk_endpoints`` to ``False`` in ironic.conf
(anticipated in the 2026.2 Hibiscus cycle, ironic 39.0.0; available earlier
by applying the linked patch).
For Keystone-authenticated deployments, add the following to policy.yaml:
"baremetal:node:ipa_heartbeat": "!"
"baremetal:driver:ipa_lookup": "!"
"baremetal:driver:ipa_continue_inspection": "!"
When using this architecture, the [deploy]external_callback_url setting can
direct the agent callback URL to the internal API service, and the
[service_catalog]endpoint_override setting can override Ironic's own internal
endpoint resolution, if required.
2. Use a fronting HTTP proxy, WSGI runner, or other external method to
restrict access to /v1/lookup, /v1/heartbeat, and /v1/continue_inspection to
only networks which run the Ironic Python Agent. This method requires no
Ironic code changes.
3. Ensure ``[api]restrict_lookup`` remains set to its default value of True.
Disabling this setting removes state-based filtering on the lookup endpoint
and significantly broadens exposure.
Credits:
Tuomo Tanskanen, Ericsson Software Technology (Metal3.io Security Team)
Dmitry Tantsur, Red Hat (Metal3.io Security Team)
Contacts / References
Authors:
Julia Kreger, Red Hat
Jay Faulkner, G-Research OSS
This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0106 Original Launchpad
bugs:
https://bugs.launchpad.net/ironic/+bug/2162821
https://bugs.launchpad.net/ironic/+bug/2162818
Proposed enhancement: https://review.opendev.org/c/openstack/ironic/+/999897
Mailing List : [security-sig] tag on [email protected]
OpenStack Security : https://security.openstack.org/
CVE: none
--- End Message ---
--- Begin Message ---
Source: ironic
Source-Version: 1:29.0.5-0+deb13u3
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
ironic, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated ironic package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 16 Jun 2026 12:46:11 +0200
Source: ironic
Architecture: source
Version: 1:29.0.5-0+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1140012 1140187 1141716 1141717 1144214
Changes:
ironic (1:29.0.5-0+deb13u3) trixie-security; urgency=medium
.
* Add follow-up patch for CVE-2026-46447 (erata1): "Fix kernel parameter
parsing for quoted values and whitespace".
* CVE-2026-54421: Sensitive properties returned unredacted in POST and PATCH
HTTP responses. Added upstream patch: "Fix sensitive properties returned on
volume targets" (Closes: #1140012).
* CVE-2026-43003 / OSSN-2026-0100: Command injection via chroot execution of
tenant-controlled binaries. Added upstream patch: "Add an agent flag to
disable installing boatloaders" (Closes: #1140187).
* CVE-2026-44918: multiple related vulnerabilities in Ironic RBAC. An
authenticated project manager can change the node associated with Volume
Connectors or Volume Target objects, potentially changing the project
permitted to access the object. Volume Connectors contain secrets in
environments configuring boot from volume with iSCSI volumes. Applied
upstream patch: "Prevent rehoming resources to nodes with different owner".
(Closes: #1141716).
* CVE-2026-54423: A malicious user with access to deploy a node directly via
Ironic can specify the IPMI `send_raw` deployment step with a malicious
payload and send commands to that nodes' BMC. Applied upstream patches:
- Add operator-configurable step disallow lists
- block vendor.send_raw
(Closes: #1141717).
* OSSN-0106: API ramdisk endpoints require network-level access controls.
Added upstream patch: "Add [api] enable_ramdisk_endpoints config option"
(Closes: #1144214).
Checksums-Sha1:
da04dddc75a899b7899e72128223af1cb4e9b08a 4096 ironic_29.0.5-0+deb13u3.dsc
b6b17bf8a174467edda78a62b7136c12b4058129 1892376 ironic_29.0.5.orig.tar.xz
290b0c28884154dbd452f03ee1e0ed2ea41cb980 76328
ironic_29.0.5-0+deb13u3.debian.tar.xz
f4c574d4cb4be5f29c5543190ca5efc849b5f746 23072
ironic_29.0.5-0+deb13u3_amd64.buildinfo
Checksums-Sha256:
68cf74aa60d9b886b0cd81e61c4f634cbd677f4014f98fb4df03545cf8cace41 4096
ironic_29.0.5-0+deb13u3.dsc
8381a472d7d79dc798a74917bf1cb8eb7795916d952643b64c7f5dc50532e6d9 1892376
ironic_29.0.5.orig.tar.xz
ebc098aa465aa552e42144c2b3134dec8a8e491a3af983d95e4dd38a4e93c8f7 76328
ironic_29.0.5-0+deb13u3.debian.tar.xz
0c648c96ed0e3b334ab24658e5cb6a40e010831d15d710219d8c75a24954df46 23072
ironic_29.0.5-0+deb13u3_amd64.buildinfo
Files:
857093036c659e8b533dadf7399c72e3 4096 net optional ironic_29.0.5-0+deb13u3.dsc
52695995363316a16620272afa449301 1892376 net optional ironic_29.0.5.orig.tar.xz
2d02b9797312893595b67dd8290d0748 76328 net optional
ironic_29.0.5-0+deb13u3.debian.tar.xz
5111e6499f4f44baa8153842e39e614b 23072 net optional
ironic_29.0.5-0+deb13u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmqBn0kACgkQ1BatFaxr
Q/7UmxAAh0C5SnyoEzIPU7bvgNOphwMIdi+FWMjZGljM9lVkezrYkIt9vUypnB3m
7+FrFDnZhMvYzqMkSB7vOPtYby1NlOXggrfbgzTQnPb8PtRh7QdpBeze4kgOpdZY
9T1XKdan8TSOfGiqb+3SlszazvyHHSnx8w3ojjeVGhzRvmJZR8+VzyhFZVBHKyvO
jRZOkMgj01hnj+rqGqOzYph9eqo30tLqsJNvjb5roDmA1fwfsnnB3OFtG8HgXvrH
0Ox4HB4uG+Lh+LBEwWg93RLrHs9PAS5GRCV2xbddqoMLVddmfZDqmF5ZoX6OBgO1
2S02mfe2jHEVV/UUM9p+k2urr3JaDkUuEjBXyOaonLmysw5WmOghl1C6jNYht/g2
sj3rMZ6wVGV/hOyS0gatO94zDB1cW7Onx+HRx7+z/OBU+X32lDRpBFnlgPyDgRe3
P1PsK/McRDeXOWV7gCkVlm4Ogdm8IsZD7/ytoc+41I7sIOwYoICIpyDpK+XDUHX/
3m1UveFp0tRl23OPFbT7b6o3VITyx5Nu0uVvtkYS/3AZdujykDcXsIk2RTdfCVQL
W7eyv46AY/B8notOINZoFlQP2tZFdYQg2R+m1zqV+aqTOmFbCQXxhGVWjwZkxhMw
ol8HOYb9uVdFZdJuOGtqK2kwbtPW80zFlDaVHau2L5o7f7B4PJs=
=wPe8
-----END PGP SIGNATURE-----
pgpg1nFKV9rnt.pgp
Description: PGP signature
--- End Message ---
