CVE-2026-17534 Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects
Attackers can bypass SSRF protections in Kimi Code to access internal network services via DNS rebinding or redirects, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-17534?
CVE-2026-17534 is a medium-severity server-side request forgery vulnerability in MoonshotAI Kimi Code, published on 27 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.
Weakness: CWE-918
Which versions are affected by CVE-2026-17534?
How do I fix CVE-2026-17534?
No fix has been published for CVE-2026-17534 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-17534 being exploited?
There is no known exploitation of CVE-2026-17534 in the wild and no public exploit code.
Sources
Also known as GHSA-28vq-345c-25gg.