{"id":"CVE-2026-17534","state":"PUBLISHED","title":"Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects","description":"Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.","publishedAt":"2026-07-27T09:19:23.982Z","updatedAt":"2026-07-27T10:24:05.709Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","source":"JFROG"},"assigner":"JFROG","products":["MoonshotAI Kimi Code"],"affected":[{"vendor":"MoonshotAI","product":"Kimi Code","packageName":"@moonshot-ai/kimi-code","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.27.0","versionType":"semver"}],"collectionURL":"https://github.com/MoonshotAI/kimi-code","repo":"git://github.com/MoonshotAI/kimi-code","programFiles":["packages/agent-core-v2/src/app/web/providers/local-fetch-url.ts","packages/agent-core/src/tools/providers/local-fetch-url.ts","packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts"]}],"references":["https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30","https://github.com/MoonshotAI/kimi-code/pull/1791","https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0","https://github.com/MoonshotAI/kimi-code"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/17xxx/CVE-2026-17534.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-17534","state":"PUBLISHED","datePublished":"2026-07-27T09:19:23.982Z","dateUpdated":"2026-07-27T10:24:05.709Z","assignerShortName":"JFROG","assignerOrgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","dateReserved":"2026-07-27T09:17:58.055Z"},"containers":{"cna":{"title":"Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects","descriptions":[{"lang":"en","value":"Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode."}],"affected":[{"vendor":"MoonshotAI","product":"Kimi Code","packageName":"@moonshot-ai/kimi-code","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.27.0","versionType":"semver"}],"collectionURL":"https://github.com/MoonshotAI/kimi-code","repo":"git://github.com/MoonshotAI/kimi-code","programFiles":["packages/agent-core-v2/src/app/web/providers/local-fetch-url.ts","packages/agent-core/src/tools/providers/local-fetch-url.ts","packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts"]}],"references":[{"url":"https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30","name":"Fix: close FetchURL SSRF bypasses and DNS-rebinding window","tags":["patch"]},{"url":"https://github.com/MoonshotAI/kimi-code/pull/1791","name":"PR #1791: close FetchURL SSRF bypasses and DNS-rebinding window","tags":["patch"]},{"url":"https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0","name":"Kimi Code 0.27.0 release","tags":["vendor-advisory"]},{"url":"https://github.com/MoonshotAI/kimi-code","name":"Kimi Code repository","tags":["product"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":5.5,"vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","lang":"en","description":"CWE-918: Server-Side Request Forgery (SSRF)","type":"CWE"}]}],"providerMetadata":{"shortName":"JFROG","orgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","dateUpdated":"2026-07-27T09:24:27.376Z"},"impacts":[{"capecId":"CAPEC-664","descriptions":[{"lang":"en","value":"CAPEC-664 Server Side Request Forgery"}]}],"configurations":[{"lang":"en","value":"Affects Kimi Code CLI/desktop agent installations before 0.27.0 when FetchURL uses the local fetch provider (including as a fallback). FetchURL is in the default auto-approve tool set. Exploitation requires the ability to influence a FetchURL invocation (for example via prompt injection) and user interaction with the agent session. Impact depends on which loopback or internal services are reachable from the host running Kimi Code.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Affects Kimi Code CLI/desktop agent installations before 0.27.0 when FetchURL uses the local fetch provider (including as a fallback). FetchURL is in the default auto-approve tool set. Exploitation requires the ability to influence a FetchURL invocation (for example via prompt injection) and user interaction with the agent session. Impact depends on which loopback or internal services are reachable from the host running Kimi Code.</p>"}]}],"solutions":[{"lang":"en","value":"Upgrade to Kimi Code 0.27.0 or later. The fix resolves hostnames via DNS and rejects addresses in loopback, RFC1918, link-local, CGNAT, and ULA ranges; follows redirects manually with per-hop revalidation; and pins connections to the validated resolved addresses to reduce DNS-rebinding (TOCTOU) races.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Upgrade to Kimi Code 0.27.0 or later. The fix resolves hostnames via DNS and rejects addresses in loopback, RFC1918, link-local, CGNAT, and ULA ranges; follows redirects manually with per-hop revalidation; and pins connections to the validated resolved addresses to reduce DNS-rebinding (TOCTOU) races.</p>"}]}],"timeline":[{"time":"2026-07-17T03:21:00.000Z","lang":"en","value":"Fix merged in MoonshotAI/kimi-code#1791 (FetchURL SSRF hardening)"},{"time":"2026-07-17T12:48:00.000Z","lang":"en","value":"Fix released in @moonshot-ai/kimi-code@0.27.0"},{"time":"2026-07-16T08:15:00.000Z","lang":"en","value":"Issue reported to Moonshot AI"}],"credits":[{"lang":"en","value":"Natan Nehorai","type":"finder"},{"lang":"en","value":"JFrog Security Research","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-27T10:23:54.927637Z","id":"CVE-2026-17534","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-27T10:24:05.709Z"}}]}}}