Affects Kimi Code CLI/desktop agent installations before 0.27.0 when FetchURL uses the local fetch provider (including as a fallback). FetchURL is in the default auto-approve tool set. Exploitation requires the ability to influence a FetchURL invocation (for example via prompt injection) and user interaction with the agent session. Impact depends on which loopback or internal services are reachable from the host running Kimi Code.
"}],"value":"Affects Kimi Code CLI/desktop agent installations before 0.27.0 when FetchURL uses the local fetch provider (including as a fallback). FetchURL is in the default auto-approve tool set. Exploitation requires the ability to influence a FetchURL invocation (for example via prompt injection) and user interaction with the agent session. Impact depends on which loopback or internal services are reachable from the host running Kimi Code."}],"credits":[{"lang":"en","type":"finder","value":"Natan Nehorai"},{"lang":"en","type":"coordinator","value":"JFrog Security Research"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.
"}],"value":"Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode."}],"impacts":[{"capecId":"CAPEC-664","descriptions":[{"lang":"en","value":"CAPEC-664 Server Side Request Forgery"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-27T09:24:27.376Z","orgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","shortName":"JFROG"},"references":[{"name":"Fix: close FetchURL SSRF bypasses and DNS-rebinding window","tags":["patch"],"url":"https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30"},{"name":"PR #1791: close FetchURL SSRF bypasses and DNS-rebinding window","tags":["patch"],"url":"https://github.com/MoonshotAI/kimi-code/pull/1791"},{"name":"Kimi Code 0.27.0 release","tags":["vendor-advisory"],"url":"https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0"},{"name":"Kimi Code repository","tags":["product"],"url":"https://github.com/MoonshotAI/kimi-code"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to Kimi Code 0.27.0 or later. The fix resolves hostnames via DNS and rejects addresses in loopback, RFC1918, link-local, CGNAT, and ULA ranges; follows redirects manually with per-hop revalidation; and pins connections to the validated resolved addresses to reduce DNS-rebinding (TOCTOU) races.
"}],"value":"Upgrade to Kimi Code 0.27.0 or later. The fix resolves hostnames via DNS and rejects addresses in loopback, RFC1918, link-local, CGNAT, and ULA ranges; follows redirects manually with per-hop revalidation; and pins connections to the validated resolved addresses to reduce DNS-rebinding (TOCTOU) races."}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2026-07-17T03:21:00.000Z","value":"Fix merged in MoonshotAI/kimi-code#1791 (FetchURL SSRF hardening)"},{"lang":"en","time":"2026-07-17T12:48:00.000Z","value":"Fix released in @moonshot-ai/kimi-code@0.27.0"},{"lang":"en","time":"2026-07-16T08:15:00.000Z","value":"Issue reported to Moonshot AI"}],"title":"Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects","x_generator":{"engine":"Vulnogram 1.0.4"}}},"cveMetadata":{"assignerOrgId":"48a46f29-ae42-4e1d-90dd-c1676c1e5e6d","assignerShortName":"JFROG","cveId":"CVE-2026-17534","datePublished":"2026-07-27T09:19:23.982Z","dateReserved":"2026-07-27T09:17:58.055Z","dateUpdated":"2026-07-27T10:24:05.709Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-27 10:16:37","lastModifiedDate":"2026-07-27 20:37:16","problem_types":["CWE-918","CWE-918 CWE-918: Server-Side Request Forgery (SSRF)"],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1,"impactScore":4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-27T10:23:54.927637Z","id":"CVE-2026-17534","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"17534","Ordinal":"1","Title":"Kimi Code FetchURL SSRF protection bypass via DNS-resolving host","CVE":"CVE-2026-17534","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"17534","Ordinal":"1","NoteData":"Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.","Type":"Description","Title":"Kimi Code FetchURL SSRF protection bypass via DNS-resolving host"}]}}}