CVE-2026-17534: Kimi Code SSRF Vulnerability

CVE-2026-17534 Overview

CVE-2026-17534 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Kimi Code (@moonshot-ai/kimi-code) versions prior to 0.27.0. The FetchURL tool implements SSRF hardening through a static hostname and IP-literal denylist in assertSafeFetchTarget. The check does not resolve DNS before the request and does not re-validate hosts after HTTP redirects. An attacker who can influence a FetchURL call, for example through prompt injection, can supply a public hostname that resolves to loopback or an internal address. FetchURL is part of the default auto-approve tool set, so no interactive user confirmation is required.

Critical Impact
Attackers can bypass the SSRF denylist to reach internal network services from the host running Kimi Code without user approval.

Affected Products

@moonshot-ai/kimi-code versions before 0.27.0
Kimi Code CLI deployments using default auto-approve tool configuration
Environments where FetchURL targets can be influenced by untrusted prompt content

Discovery Timeline

2026-07-27 - CVE-2026-17534 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-17534

Vulnerability Analysis

The vulnerability sits in the assertSafeFetchTarget guard used by the FetchURL tool. The function enforces a static denylist of hostnames and IP literals intended to block requests to loopback, link-local, and private ranges. It does not perform DNS resolution before dispatching the outbound request. It also does not re-run the safety check when the HTTP client follows a redirect.

An attacker who influences a FetchURL invocation can supply a public hostname whose DNS record points to 127.0.0.1, 169.254.169.254, or another internal address. The literal string check passes because the hostname itself is not on the denylist. The HTTP client then resolves the name and connects to the internal target. A public URL that returns an HTTP redirect to an internal address achieves the same result.

Because FetchURL is included in the default auto-approve tool set, the request executes without prompting the operator in manual mode. This allows prompt-injection payloads embedded in documents, web pages, or tool output to trigger internal requests silently.

Root Cause

The root cause is incomplete input validation in assertSafeFetchTarget. The denylist operates on the pre-resolution hostname string and is not re-evaluated across redirects, leaving DNS rebinding and redirect-based SSRF paths open.

Attack Vector

Exploitation requires an attacker-controlled input reaching a FetchURL call, typically via prompt injection. The attacker supplies a URL whose hostname is public but resolves to an internal service, or a public URL that issues a 3xx redirect to an internal target. Common internal targets include cloud metadata endpoints, container orchestration APIs, and localhost admin interfaces.

Refer to the Kimi Code Pull Request #1791 and remediation commit for the corrected validation logic.

Detection Methods for CVE-2026-17534

Indicators of Compromise

Outbound DNS queries from the Kimi Code host resolving public names to RFC1918, loopback, or link-local addresses
FetchURL tool invocations targeting hostnames that redirect to internal IPs
Unexpected connections from the Kimi Code process to 169.254.169.254, 127.0.0.1, or internal service ports
Prompt content or tool output containing URLs designed to trigger internal fetches

Detection Strategies

Log all FetchURL invocations with the resolved destination IP and compare against expected external ranges
Alert on HTTP responses with 3xx status codes where the redirect target is a private or loopback address
Correlate agent tool-call telemetry with egress network flows to spot denylist bypasses

Monitoring Recommendations

Monitor process-level network telemetry from Node.js runtimes hosting @moonshot-ai/kimi-code
Capture agent audit logs including full URL, redirect chain, and final connected address
Baseline expected FetchURL destinations and flag deviations to internal or cloud metadata endpoints

How to Mitigate CVE-2026-17534

Immediate Actions Required

Upgrade @moonshot-ai/kimi-code to version 0.27.0 or later
Remove FetchURL from the auto-approve tool set until the upgrade is verified
Audit recent FetchURL activity for requests to internal or metadata addresses

Patch Information

The fix is delivered in Kimi Code 0.27.0. The change resolves target hostnames before validation and re-applies the safety check after each redirect. Technical details are documented in the remediation commit and the associated pull request.

Workarounds

Require interactive approval for FetchURL by removing it from the auto-approve list
Run Kimi Code behind an egress proxy that blocks RFC1918, loopback, and cloud metadata destinations
Restrict outbound network access from the host to an explicit allowlist of external domains
Disable HTTP redirect following in environments where custom configuration is possible

bash

# Configuration example
npm install @moonshot-ai/kimi-code@0.27.0