OSSN-0104: Ironic-Python-Agent may fallback to mDNS unexpectedly

Summary

Ironic-Python-Agent (IPA) has had support for several releases for configuring your agent via multicast DNS (mDNS). This feature’s design is such that, in some extremely rare cases, a booted IPA could be reconfigured or directed to a different Ironic API service.

Affected Services / Software

ironic-python-agent (>=3.7.0 <11.6.2)

Discussion

When IPA is booted, the first thing it does is look for a valid URL to check into the Ironic API or an Ironic Inspection service. The mDNS fallback would, in situations where IPA had no API url configured, use mDNS lookups to configure IPA, including the endpoint of the Ironic API service. This is typically only used in rare cases for bootstrapping clusters with minimal infrastructure using virtual media or physical USB thumb drives.

Ironic’s default configuration always sends a valid API url. The current development branch has been updated to always require an explicit opt-in to mDNS fallback, either by setting ipa-api-url to mdns, or by setting ipa-use-mdns to True on the command line.

Recommended Actions

Ensure all IPA boots are managed by Ironic; do not boot any IPA ramdisks without proper configuration. This is the default behavior but may be different in environments with unique networking or DHCP configurations.

Operators utilizing the mDNS discovery features should, before upgrading to 2026.2, ensure they are explicitly enabling mDNS fallback in their virtual media images.

Patches: The following patches are backwards incompatible and were not merged into stable branches. Operators are welcome to backport them manually if they feel it improves their security standing and they do not use mDNS fallback.

2026.2/hibiscus (development):

• https://review.opendev.org/997637

• https://review.opendev.org/997638

• https://review.opendev.org/999337

Credits:

• Dmitry Tantsur, Red Hat (Metal3.io Security Team),

• Tuomo Tanskanen, Ericsson Software Technology (Metal3.io Security Team)

Contacts / References

Author: Jay Faulkner, G-Research OSS

• This OSSN : https://docs.openstack.org/security-notes/OSSN-0104.html

• Original Launchpad bug : https://bugs.launchpad.net/ironic-python-agent/+bug/2160054

• Mailing List : openstack-discuss@lists.openstack.org

• OpenStack Security : https://security.openstack.org/

• CVE : none