CVE-2026-17534
Received Received - Intake

Server-Side Request Forgery in Kimi Code

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: JFrog

Description
Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-17534
EUVD
EUVD-2026-49134

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
moonshot-ai kimi_code to 0.27.0 (exc)
moonshot-ai kimi-code to 0.27.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) in the Kimi Code tool's FetchURL feature. The issue occurs because the tool uses a static hostname and IP denylist to block unsafe requests but fails to re-validate hosts after DNS resolution or HTTP redirects. An attacker can bypass these protections by providing a crafted domain that resolves to internal addresses (like loopback) or by using redirects to route requests to restricted services. Since FetchURL is in the default auto-approve tool set, this can happen without user interaction.

Detection Guidance

Detecting this SSRF vulnerability requires checking if Kimi Code versions before 0.27.0 are installed and if FetchURL is used in auto-approve mode. Inspect the tool's configuration and logs for unexpected outbound requests to loopback or internal addresses. Use network monitoring tools to identify connections to suspicious domains or IPs.

Impact Analysis

If you use Kimi Code with FetchURL, an attacker could exploit this to access internal network services on your machine via prompt injection. This might allow them to interact with local applications, APIs, or cloud metadata endpoints, potentially leading to data theft, service disruption, or further network compromise.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR (e.g., unauthorized data access) or HIPAA (e.g., exposure of protected health information). Organizations using Kimi Code may face compliance risks if internal services are compromised through this flaw.

Mitigation Strategies

Upgrade Kimi Code to version 0.27.0 or later to apply the SSRF fixes. Disable auto-approve for FetchURL if interactive confirmation is acceptable. Review network policies to block outbound connections to internal or loopback ranges. Monitor for unusual FetchURL activity in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17534. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart