Packages / Debian 13 (Trixie) / net / ironic-conductor

Package: ironic-conductor (1:29.0.5-0+deb13u2)

bare metal hypervisor API for OpenStack - conductor

Other Packages Related to ironic-conductor:

dep: [ipmitool]
utility for IPMI control with kernel driver or LAN interface (daemon)
dep: [ipxe]
PXE boot firmware
dep: [ironic-common] (= 1:29.0.5-0+deb13u2)
bare metal hypervisor API for OpenStack - common files
dep: [open-iscsi]
iSCSI initiator tools
dep: [pxelinux]
collection of bootloaders (PXE network bootloader)
dep: [qemu-utils]
QEMU utilities
dep: [tftpd-hpa]
HPA's tftp server
dep: [xinetd]
replacement for inetd with many enhancements

sug: [syslinux]
collection of bootloaders (DOS FAT and NTFS bootloader)
sug: [syslinux-common]
collection of bootloaders (common)

Download ironic-conductor

Architecture	Package size	Installed size	Files	Package
all	11 KiB	35 KiB	list of files	Download

Package file paths (0)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

No package-associated file paths were observed for the displayed build metadata.

Field source: Debian 13 (Trixie) main amd64

Use this package

OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.

Try Debian 13 (Trixie) in the browser Build an image that includes ironic-conductor

Versions, suites, and repositories

Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.

Version	Release	Architecture	Repository	Package size	Installed size	Publisher repository artifact
1:29.0.5-0+deb13u2	trixie / main	all	Debian 13 · main · amd64	10 KiB	35 KiB	pool/main/i/ironic/ironic-conductor_29.0.5-0+deb13u2_all.deb
1:29.0.5-0+deb13u2	trixie / main	all	Debian 13 · main · arm64	10 KiB	35 KiB	pool/main/i/ironic/ironic-conductor_29.0.5-0+deb13u2_all.deb
1:29.0.5-0+deb13u3	trixie-security / main	all	Debian 13 security · main · arm64	11 KiB	35 KiB	pool/updates/main/i/ironic/ironic-conductor_29.0.5-0+deb13u3_all.deb
1:29.0.5-0+deb13u3	trixie-security / main	all	Debian 13 security · main · amd64	11 KiB	35 KiB	pool/updates/main/i/ironic/ironic-conductor_29.0.5-0+deb13u3_all.deb
1:29.0.5-0+deb13u2 (withdrawn)	trixie-security / main	all	Debian 13 security · main · amd64	10 KiB	35 KiB	pool/updates/main/i/ironic/ironic-conductor_29.0.5-0+deb13u2_all.deb

Field source: Debian 13 (Trixie) main amd64

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-115638] ironic: CVE-2026-115638	Medium(4.3)	Affected Details (5) `1:29.0.5-0+deb13u2` · all · trixie Affected dsa · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Affected dsa · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Affected dsa · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Affected dsa · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Affected dsa · ironic · debian · 13
[CVE-2026-90461] OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.	Medium(6.3)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:11:42 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Affected nvd · ironic · debian · 13
[CVE-2026-74250] In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.	Medium(6.3)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:41:58 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Affected nvd · ironic · debian · 13
[CVE-2026-71201] In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.	Medium(5)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:42:38 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Affected nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Affected nvd · ironic · debian · 13
[CVE-2026-54423] In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node,	High(8.2)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:44:23 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13
[CVE-2026-44918] OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.	High(8.7)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:44:23 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13
[CVE-2026-54421] In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials	Medium(6.8)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:46:17 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13
[CVE-2026-48681] OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.	Medium(5.9)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:47:52 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13
[CVE-2026-44917] OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.	Medium(4.9)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:47:52 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13
[CVE-2026-46447] OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.	Medium(5.8)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:47:52 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u2` nvd · ironic · debian · 13
[CVE-2026-44919] In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.	Medium(4.3)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 10:03:28 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13
[CVE-2026-44916] In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.	Low(3)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 10:07:43 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13
[CVE-2026-42997] An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-l	High(7.7)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 10:21:37 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13
[CVE-2026-43003] An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading t	High(8.5)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 10:25:55 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Affected · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u3` nvd · ironic · debian · 13
[CVE-2026-42510] OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.	Medium(6.6)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 10:26:20 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:29.0.5-0+deb13u1` nvd · ironic · debian · 13
[CVE-2015-7514] ironic: CVE-2015-7514	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:16:17 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:4.2.2-1` dsa · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:4.2.2-1` dsa · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Fixed · Fixed: `1:4.2.2-1` dsa · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:4.2.2-1` dsa · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:4.2.2-1` dsa · ironic · debian · 13
[CVE-2016-4985] ironic: CVE-2016-4985	Medium(5.9)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:21:51 PM UTC Details (5) `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:5.1.2-1` dsa · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie Fixed · Fixed: `1:5.1.2-1` dsa · ironic · debian · 13 `1:29.0.5-0+deb13u2` · all · trixie-security · Historical version Fixed · Fixed: `1:5.1.2-1` dsa · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:5.1.2-1` dsa · ironic · debian · 13 `1:29.0.5-0+deb13u3` · all · trixie-security Fixed · Fixed: `1:5.1.2-1` dsa · ironic · debian · 13

Last synced: Oct 24, 2026, 3:02:58 AM UTC

[CVE catalog]

Checksums

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

1:29.0.5-0+deb13u2 / allObserved Sep 1, 2026sha256 3263dd2d523f…174b460dSource-reported digest