Ubuntu USN · USN-8421-1

Ironic vulnerabilities

Published: Thu, 11 Jun 2026 12:22

CVE-2026-48681CVE-2026-44917CVE-2026-46447

Summary

Several security issues were fixed in Ironic.

Details

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate file paths when handling ISO images. A privileged authenticated remote user could use this issue to perform path traversal via a crafted ISO image and overwrite arbitrary files on the Ironic conductor. (CVE-2026-48681) Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate kernel command line parameters. A privileged authenticated remote user could use this issue to inject scripts during node boot and possibly execute arbitrary code. (CVE-2026-46447) Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic incorrectly restricted access to custom PXE templates. A privileged authenticated remote user could use this issue to read arbitrary sensitive files on the Ironic conductor. (CVE-2026-44917)

Recommended actions per Ubuntu release

StackPatch playbook auto-generated per release codename and per affected package.

Ubuntu jammy

ironic→1:20.1.0-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 1:20.1.0-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-api→1:20.1.0-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 1:20.1.0-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-api
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-common→1:20.1.0-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 1:20.1.0-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-conductor→1:20.1.0-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 1:20.1.0-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-conductor
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
python3-ironic→1:20.1.0-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 1:20.1.0-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y python3-ironic
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu noble

ironic→1:24.1.1-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 1:24.1.1-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-api→1:24.1.1-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 1:24.1.1-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-api
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-common→1:24.1.1-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 1:24.1.1-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-conductor→1:24.1.1-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 1:24.1.1-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-conductor
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
python3-ironic→1:24.1.1-0ubuntu1.3apt_upgrade
Standard apt upgrade. Install 1:24.1.1-0ubuntu1.3 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y python3-ironic
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu questing

ironic→1:32.0.0-0ubuntu1.1apt_upgrade
Standard apt upgrade. Install 1:32.0.0-0ubuntu1.1 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-api→1:32.0.0-0ubuntu1.1apt_upgrade
Standard apt upgrade. Install 1:32.0.0-0ubuntu1.1 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-api
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-common→1:32.0.0-0ubuntu1.1apt_upgrade
Standard apt upgrade. Install 1:32.0.0-0ubuntu1.1 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-conductor→1:32.0.0-0ubuntu1.1apt_upgrade
Standard apt upgrade. Install 1:32.0.0-0ubuntu1.1 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-conductor
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
python3-ironic→1:32.0.0-0ubuntu1.1apt_upgrade
Standard apt upgrade. Install 1:32.0.0-0ubuntu1.1 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y python3-ironic
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Ubuntu resolute

ironic→1:35.0.0-0ubuntu2.1apt_upgrade
Standard apt upgrade. Install 1:35.0.0-0ubuntu2.1 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-api→1:35.0.0-0ubuntu2.1apt_upgrade
Standard apt upgrade. Install 1:35.0.0-0ubuntu2.1 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-api
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-common→1:35.0.0-0ubuntu2.1apt_upgrade
Standard apt upgrade. Install 1:35.0.0-0ubuntu2.1 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-common
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
ironic-conductor→1:35.0.0-0ubuntu2.1apt_upgrade
Standard apt upgrade. Install 1:35.0.0-0ubuntu2.1 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y ironic-conductor
```
Most apt upgrades restart their service automatically. needrestart lists anything else.
python3-ironic→1:35.0.0-0ubuntu2.1apt_upgrade
Standard apt upgrade. Install 1:35.0.0-0ubuntu2.1 from the apt repo.
```
sudo apt-get update
sudo apt-get install --only-upgrade -y python3-ironic
```
Most apt upgrades restart their service automatically. needrestart lists anything else.

Are YOU affected by USN-8421-1?

5-second check on your actual server. Reads /etc/os-release, uname -r, and dpkg-query; matches against the live USN + Debian Security Tracker feeds; tells you whether USN-8421-1 (and any other live CVE) applies. Anonymous, no signup.

curl https://mindsparkstack.com/scan.sh | bash

Form-based quickscan Read the bash source first

Want this automated for your servers?

StackPatch runs this match against YOUR installed packages every hour

Free 1-server / $99 lifetime founder seat (50 only) / $19+/mo monthly. Indie pricing.

Buy lifetime →See StackPatch →Live audit log →