As per upstream announce at:
https://wiki.openstack.org/wiki/OSSN/OSSN-0106

Ironic API ramdisk endpoints require network-level access controls

Summary:
The Ironic Bare Metal API combines authenticated endpoints for client use with
unauthenticated endpoints for coordination with the Ironic Python Agent
ramdisk into a single API service. Depending on the deployment architecture,
this can expose security risks if the unauthenticated endpoints are reachable
from untrusted networks.

Affected Services / Software:
    ironic: >=6.2.0
        /v1/lookup and /v1/heartbeat: API version 1.22 (Newton, ironic 6.2.0)
        /v1/continue_inspection: API version 1.84 (2024.2)

Discussion:
Ironic has three endpoints which allow unauthenticated access:

    GET /v1/lookup
    POST /v1/heartbeat/{node_ident}
    POST /v1/continue_inspection


These endpoints are a documented aspect of Ironic's architecture and are
covered in the Ironic security guide. They already have significant security
controls to mitigate risk, such as bootstrapping into credentials via the
agent token mechanism (mandatory since the Victoria release), callback URL
validation, and defaulting to limiting access to nodes whose provisioning
state requires use of them.

Regardless of authentication methodology, operators in multi-tenant or
untrusted environments should deploy a split-horizon API configuration where
the unauthenticated endpoints are not reachable from public or tenant networks.
Using Keystone does not eliminate the need for this network-level separation.
Previously, Ironic only provided policy-based overrides to disable these
endpoints, which required Keystone and left operators using HTTP basic auth or
noauth without an equivalent control. A new ``[api]enable_ramdisk_endpoints``
configuration option is being added to allow any operator, regardless of
authentication methodology, to disable these endpoints on a per-service basis.

For full details on the security model around these endpoints, refer to the
Ironic security guide:
https://docs.openstack.org/ironic/latest/admin/security.html

Recommended Actions:
Operators using Ironic in a multi-tenant or untrusted environment should
configure the Ironic API so that the unauthenticated endpoints are only
accessible from networks where the Ironic Python Agent ramdisk operates. This
can be achieved in several ways depending on infrastructure setup:

1. Run separate public-facing and ramdisk-facing Ironic API services.

WARNING: Disabling the ramdisk endpoints without maintaining a separate API
service that the Ironic Python Agent can reach will break all deployment,
cleaning, inspection, rescue, and servicing workflows. These endpoints must
remain available to the ramdisk on at least one API service.

On the public-facing service, disable the ramdisk endpoints using one of the
following methods:

    Set ``[api]enable_ramdisk_endpoints`` to ``False`` in ironic.conf
    (anticipated in the 2026.2 Hibiscus cycle, ironic 39.0.0; available earlier
    by applying the linked patch).
    For Keystone-authenticated deployments, add the following to policy.yaml:

      "baremetal:node:ipa_heartbeat": "!"
      "baremetal:driver:ipa_lookup": "!"
      "baremetal:driver:ipa_continue_inspection": "!"

When using this architecture, the [deploy]external_callback_url setting can
direct the agent callback URL to the internal API service, and the
[service_catalog]endpoint_override setting can override Ironic's own internal
endpoint resolution, if required.

2. Use a fronting HTTP proxy, WSGI runner, or other external method to
restrict access to /v1/lookup, /v1/heartbeat, and /v1/continue_inspection to
only networks which run the Ironic Python Agent. This method requires no
Ironic code changes.

3. Ensure ``[api]restrict_lookup`` remains set to its default value of True.
Disabling this setting removes state-based filtering on the lookup endpoint
and significantly broadens exposure.

Credits:
    Tuomo Tanskanen, Ericsson Software Technology (Metal3.io Security Team)
    Dmitry Tantsur, Red Hat (Metal3.io Security Team)

Contacts / References

Authors:
    Julia Kreger, Red Hat
    Jay Faulkner, G-Research OSS


This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0106 Original Launchpad
bugs:

https://bugs.launchpad.net/ironic/+bug/2162821
https://bugs.launchpad.net/ironic/+bug/2162818


Proposed enhancement: https://review.opendev.org/c/openstack/ironic/+/999897

Mailing List : [security-sig] tag on openstack-discuss@lists.openstack.org

OpenStack Security : https://security.openstack.org/

CVE: none

Hello,

Bug #1144214 in ironic reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/ironic/-/commit/be529234d2ca62ba13fdddffcc907194c478a3c5
------------------------------------------------------------------------
* OSSN-0106: API ramdisk endpoints require network-level access controls.
    Added upstream patch: "Add [api] enable_ramdisk_endpoints config option"
    (Closes: #1144214).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1144214

We believe that the bug you reported is fixed in the latest version of
ironic, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144214@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated ironic package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 12 Aug 2026 14:39:05 +0200
Source: ironic
Architecture: source
Version: 1:35.0.1-10
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1144214
Changes:
 ironic (1:35.0.1-10) unstable; urgency=medium
 .
   * OSSN-0106: API ramdisk endpoints require network-level access controls.
     Added upstream patch: "Add [api] enable_ramdisk_endpoints config option"
     (Closes: #1144214).
Checksums-Sha1:
 77685beeaf2ebc6431aa3bb1b0152d342303c69e 4067 ironic_35.0.1-10.dsc
 5df41402ad538491d7b1b78958622d338b969c0f 65204 ironic_35.0.1-10.debian.tar.xz
 51099de92168d0e31f433fc88321014fb18faa1c 22521 ironic_35.0.1-10_amd64.buildinfo
Checksums-Sha256:
 3461cc3dfa2dcd74e650130a2c8f88620cc90ede339697ddcda94cabcfefb127 4067 ironic_35.0.1-10.dsc
 ba693acff0d38dd81af261a7c2ff6de440d77b66847a22ef8a7350ab4a3c5642 65204 ironic_35.0.1-10.debian.tar.xz
 d7be8aaa75af467921c1c9f411791d5f53b1f489798f8c8e1afcbfdd87ea860b 22521 ironic_35.0.1-10_amd64.buildinfo
Files:
 4500036b5b81f4c1a70ab0c31a526287 4067 net optional ironic_35.0.1-10.dsc
 e1f1222f33740fa2d8d06fedfb05da39 65204 net optional ironic_35.0.1-10.debian.tar.xz
 1d7ac59ce97a57c599a0dc61c0adfb91 22521 net optional ironic_35.0.1-10_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp8bGEACgkQ1BatFaxr
Q/6bmQ//cX5V2RSH/+pQxeSNI3SUdzm6ZfSMdBZi5AlzcjUFKYP7kke4DQz6TKQ0
KAQ+86Fxhofn+z037v6J1XmmUaZF8b6P4mEAHbZoy7A5K20+bX8C9bTyZ3KGT3+z
4vPOJevo4D0Eh8DOaUt8zW3QF5l6fcwJ1b9aDoeQnrMmyD6WLv/vO60gnAOc4Wvn
QA2rYGSX2DyuT378vN8B0JHpx+xzb22NHpH1UTW4kamha1E14IPc4dpOjCfHqhUI
wiq4BNHOxOsi4QZt/Oef+4E9Rb7yoT3Ztx3SrmN7pOxHbtNSVNBD5ASoYb+FR9r1
je5GC48B5n/39XupF0vJzLT3F4lXipWlCQfWu3TGrz5T5Vev1AIulJjc80WmmFsp
Qnn1eOJVDm2F6IEbPN36xonUCBMUgxy99svrFnxz0arP8WWXewyP/SdB4v21aUyK
9K3wNSZnyf+lTw4JVQzHgcIVn7V9yeYxmNiA92beGdShZadJidzNhpAUrRtNgDHL
MvrtAQzC6QKiL2crF3rH1rncWNp2VIm9+T/4TaVrQxqMZYbrH4UhNSOz4KcdFDPU
h95B+CGFgYFt12LtIsgziSLrHe18VFkQsdcEPvB7cfiJNFIzJTMRUpus6FqzcaOU
ggkHEvv4JkObuEtKO7piGqIVkp8fhYgBk4Kpm8zMpbh/D29x5x0=
=jIsw
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
ironic, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144214@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated ironic package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 16 Jun 2026 12:46:11 +0200
Source: ironic
Architecture: source
Version: 1:29.0.5-0+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1140012 1140187 1141716 1141717 1144214
Changes:
 ironic (1:29.0.5-0+deb13u3) trixie-security; urgency=medium
 .
   * Add follow-up patch for CVE-2026-46447 (erata1): "Fix kernel parameter
     parsing for quoted values and whitespace".
   * CVE-2026-54421: Sensitive properties returned unredacted in POST and PATCH
     HTTP responses. Added upstream patch: "Fix sensitive properties returned on
     volume targets" (Closes: #1140012).
   * CVE-2026-43003 / OSSN-2026-0100: Command injection via chroot execution of
     tenant-controlled binaries. Added upstream patch: "Add an agent flag to
     disable installing boatloaders" (Closes: #1140187).
   * CVE-2026-44918: multiple related vulnerabilities in Ironic RBAC. An
     authenticated project manager can change the node associated with Volume
     Connectors or Volume Target objects, potentially changing the project
     permitted to access the object. Volume Connectors contain secrets in
     environments configuring boot from volume with iSCSI volumes. Applied
     upstream patch: "Prevent rehoming resources to nodes with different owner".
     (Closes: #1141716).
   * CVE-2026-54423: A malicious user with access to deploy a node directly via
     Ironic can specify the IPMI `send_raw` deployment step with a malicious
     payload and send commands to that nodes' BMC. Applied upstream patches:
     - Add operator-configurable step disallow lists
     - block vendor.send_raw
     (Closes: #1141717).
   * OSSN-0106: API ramdisk endpoints require network-level access controls.
     Added upstream patch: "Add [api] enable_ramdisk_endpoints config option"
     (Closes: #1144214).
Checksums-Sha1:
 da04dddc75a899b7899e72128223af1cb4e9b08a 4096 ironic_29.0.5-0+deb13u3.dsc
 b6b17bf8a174467edda78a62b7136c12b4058129 1892376 ironic_29.0.5.orig.tar.xz
 290b0c28884154dbd452f03ee1e0ed2ea41cb980 76328 ironic_29.0.5-0+deb13u3.debian.tar.xz
 f4c574d4cb4be5f29c5543190ca5efc849b5f746 23072 ironic_29.0.5-0+deb13u3_amd64.buildinfo
Checksums-Sha256:
 68cf74aa60d9b886b0cd81e61c4f634cbd677f4014f98fb4df03545cf8cace41 4096 ironic_29.0.5-0+deb13u3.dsc
 8381a472d7d79dc798a74917bf1cb8eb7795916d952643b64c7f5dc50532e6d9 1892376 ironic_29.0.5.orig.tar.xz
 ebc098aa465aa552e42144c2b3134dec8a8e491a3af983d95e4dd38a4e93c8f7 76328 ironic_29.0.5-0+deb13u3.debian.tar.xz
 0c648c96ed0e3b334ab24658e5cb6a40e010831d15d710219d8c75a24954df46 23072 ironic_29.0.5-0+deb13u3_amd64.buildinfo
Files:
 857093036c659e8b533dadf7399c72e3 4096 net optional ironic_29.0.5-0+deb13u3.dsc
 52695995363316a16620272afa449301 1892376 net optional ironic_29.0.5.orig.tar.xz
 2d02b9797312893595b67dd8290d0748 76328 net optional ironic_29.0.5-0+deb13u3.debian.tar.xz
 5111e6499f4f44baa8153842e39e614b 23072 net optional ironic_29.0.5-0+deb13u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmqBn0kACgkQ1BatFaxr
Q/7UmxAAh0C5SnyoEzIPU7bvgNOphwMIdi+FWMjZGljM9lVkezrYkIt9vUypnB3m
7+FrFDnZhMvYzqMkSB7vOPtYby1NlOXggrfbgzTQnPb8PtRh7QdpBeze4kgOpdZY
9T1XKdan8TSOfGiqb+3SlszazvyHHSnx8w3ojjeVGhzRvmJZR8+VzyhFZVBHKyvO
jRZOkMgj01hnj+rqGqOzYph9eqo30tLqsJNvjb5roDmA1fwfsnnB3OFtG8HgXvrH
0Ox4HB4uG+Lh+LBEwWg93RLrHs9PAS5GRCV2xbddqoMLVddmfZDqmF5ZoX6OBgO1
2S02mfe2jHEVV/UUM9p+k2urr3JaDkUuEjBXyOaonLmysw5WmOghl1C6jNYht/g2
sj3rMZ6wVGV/hOyS0gatO94zDB1cW7Onx+HRx7+z/OBU+X32lDRpBFnlgPyDgRe3
P1PsK/McRDeXOWV7gCkVlm4Ogdm8IsZD7/ytoc+41I7sIOwYoICIpyDpK+XDUHX/
3m1UveFp0tRl23OPFbT7b6o3VITyx5Nu0uVvtkYS/3AZdujykDcXsIk2RTdfCVQL
W7eyv46AY/B8notOINZoFlQP2tZFdYQg2R+m1zqV+aqTOmFbCQXxhGVWjwZkxhMw
ol8HOYb9uVdFZdJuOGtqK2kwbtPW80zFlDaVHau2L5o7f7B4PJs=
=wPe8
-----END PGP SIGNATURE-----