As per upstream announce here:
https://wiki.openstack.org/wiki/OSSN/OSSN-0104

Summary:
Ironic-Python-Agent (IPA) has had support for several releases for configuring
your agent via multicast DNS (mDNS). This feature's design is such that, in
some extremely rare cases, a booted IPA could be reconfigured or directed to a
different Ironic API service.

Affected Services / Software:
    ironic-python-agent: >=3.7.0 <11.6.2

Discussion:

When IPA is booted, the first thing it does is look for a valid URL to check
into the Ironic API or an Ironic Inspection service. The mDNS fallback would,
in situations where IPA had no API url configured, use mDNS lookups to
configure IPA, including the endpoint of the Ironic API service. This is
typically only used in rare cases for bootstrapping clusters with minimal
infrastructure using virtual media or physical USB thumb drives.

Ironic's default configuration always sends a valid API url. The current
development branch has been updated to always require an explicit opt-in to
mDNS fallback, either by setting ``ipa-api-url`` to ``mdns``, or by setting
``ipa-use-mdns`` to ``True`` on the command line.

Recommended Actions:
    Ensure all IPA boots are managed by Ironic; do not boot any IPA ramdisks
without proper configuration. This is the default behavior but may be
different in environments with unique networking or DHCP configurations.
    Operators utilizing the mDNS discovery features should, before upgrading
to 2026.2, ensure they are explicitly enabling mDNS fallback in their virtual
media images.

Patches:

The following patches are backwards incompatible and were not merged into stable branches. Operators are welcome to backport them manually if they feel it improves their security standing and they do not use mDNS fallback.
2026.2/hibiscus (development)

https://review.opendev.org/997637
https://review.opendev.org/997638
https://review.opendev.org/999337

Credits:
    Dmitry Tantsur, Red Hat (Metal3.io Security Team)
    Tuomo Tanskanen, Ericsson Software Technology (Metal3.io Security Team)

Authors:
    Jay Faulkner, G-Research OSS

Notes:
    This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0104
    Original Launchpad bug: https://bugs.launchpad.net/ironic-python-agent/+bug/2160054
    Mailing List : [security-sig] tag on openstack-discuss@lists.openstack.org
    OpenStack Security : https://security.openstack.org/
    CVE: none

We believe that the bug you reported is fixed in the latest version of
ironic-python-agent, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1143805@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated ironic-python-agent package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 06 Aug 2026 14:31:10 +0200
Source: ironic-python-agent
Architecture: source
Version: 11.5.0-5
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1143805
Changes:
 ironic-python-agent (11.5.0-5) unstable; urgency=medium
 .
   * OSSN-0104: Ironic-Python-Agent may fallback to mDNS unexpectedly. Applied
     upstream patches:
     - Make mDNS discovery explicitly opt-in
     - Allow limiting what config can be set in mDNS
     - Set a minimal default mdns config key list for IPA
     (Closes: #1143805).
Checksums-Sha1:
 1825ba868c793f3c4c83e7ce6eca9c6f920f22a3 2661 ironic-python-agent_11.5.0-5.dsc
 1f0435c6ef4e1c232d2a743fc31cd76d27ebc530 19440 ironic-python-agent_11.5.0-5.debian.tar.xz
 9d5c3127b1ba6670f045ea077ee7b849e219ea00 12488 ironic-python-agent_11.5.0-5_amd64.buildinfo
Checksums-Sha256:
 380077a3d70a715faabfb1e511d38f7ee401efca1e6491065a8a925679a1287e 2661 ironic-python-agent_11.5.0-5.dsc
 32a58804e8b3378d1c1b3b3baa8677a756da4f3ab04255a4a7027616b0fbc45c 19440 ironic-python-agent_11.5.0-5.debian.tar.xz
 bd9196604154fee5cd754830acfe38741614d84616e197fe132e5608ff11387a 12488 ironic-python-agent_11.5.0-5_amd64.buildinfo
Files:
 c84b889d81a9bc46b6b8185891090e5d 2661 net optional ironic-python-agent_11.5.0-5.dsc
 35af85e5dda8910cd4cada5e10054dc3 19440 net optional ironic-python-agent_11.5.0-5.debian.tar.xz
 96b265773bfa74d4f5a01545fdb236f0 12488 net optional ironic-python-agent_11.5.0-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp0jr0ACgkQ1BatFaxr
Q/5dEBAAmI1oGb3JtazUIlvJxB1lHLVnXFWFbdIobDIeRe3/6RBoO0vvUF18JBmp
oXQYmCYrmaC9h3lgYnMRjyhzVd3DMQydAk7Qan2olLVWSSDTKCavUP1Uv3Tikkcc
vLfRHjy5w7QzPfDWGS8nBvw77oDK2Dg2ZaGCYkMze1bEukRy/QXrchyOnpQLD7ds
7k5qRsKJA5lbCjZ7wKZ/Fzvl1SFlYfYTAULsJH4kcJiPz6OveIwCmq1LLKcFqu3X
0+p9F0ZSESChl+qegeC/R863Qoq4wvBZIxmbZO6AzF0vUiHcFxWlvfU3cFgPyPRU
UpIGRdXn8t08p8IbG8q8Y8HFPgDy5wIfc7WLHwjQKAc2/vSYSeyOM7s+PErELq0M
+rd/LjWD7/4nloUAsGLZyCvHeUtQWzsFufyzB8+WgzsvyY+JchGY4ZF7fpt96TSC
3usMQzg6vB7MPmZxX6Tcv0H9xkWWjSwjtB6O4KTQ20YLHNyOoMgo6QN82THbc0Bp
L0wO9RmF7N+wOCx+uxnMpt17k4A6JWnVXwV+JhcwgTLWZhsjkpheHiyjbr5VjPov
rQADnFzPPtGcHJwrqMQsrupSKXuGNsZ+pWq4oof/g9gQJzuFaNUd+UJ9yKD5lJyb
jPcZ+RMLpZZKiykiFiokH8DwVie5ZN4kEbJJpMqm09oi44AqFos=
=t8k9
-----END PGP SIGNATURE-----