< Back

JFSA-2026-001667223 - Kimi Code is vulnerable to a FetchURL SSRF Protection Bypass via DNS-resolving Hostnames and Redirects

CVE-2026-17534 | CVSS 5.5

JFrog Severity:medium

Discovered ByNatan Nehoraiof the JFrog Security Research Team

Published 27 Jul, 2026 | Last updated 27 Jul, 2026

Kimi Code is vulnerable to a FetchURL SSRF Protection Bypass via DNS-resolving Hostnames and Redirects

@moonshot-ai/kimi-code (Kimi Code)

< 0.27.0

Kimi Code implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call, for example via prompt injection, can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.


Step 1 - Start a local HTTP listener


python3 -m http.server 1337 --bind 127.0.0.1


Step 2 - Confirm the literal denylist blocks localhost


Ask the agent to use FetchURL on http://localhost:1337 (or http://127.0.0.1:1337).


Expected result: the request is denied by assertSafeFetchTarget (for example, "Refusing to fetch private host").


Step 3 - Bypass via a DNS-resolving hostname


Ask the agent to use FetchURL on a public hostname whose DNS resolves to loopback, for example http://localtest.me:1337.


Step 4 - Verify the request reaches the local listener


Watch the simple HTTP server console. A GET request arrives from the Kimi Code process, demonstrating that DNS-resolving names are not validated against private address ranges.


The same class of bypass applies to public URLs that HTTP-redirect to loopback or internal targets, because redirects were followed without re-running the safety check on each hop.

Upgrade to Kimi Code 0.27.0 or later. The fix resolves hostnames via DNS and rejects addresses in loopback, RFC1918, link-local, CGNAT, and ULA ranges; follows redirects manually with per-hop revalidation; and pins connections to the validated resolved addresses to reduce DNS-rebinding (TOCTOU) races.

https://github.com/MoonshotAI/kimi-code/pull/1791 https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30 https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0

< Back