# CVE-2026-17534: MoonshotAI Kimi Code SSRF bypass in FetchURL tool

Source: https://junglewise.ai/threats/cve-2026-17534-moonshotai-kimi-code-ssrf-bypass-in-fetchurl-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-17534 · Severity: medium · CVSS 5.5 · Published 2026-07-27

Kimi Code is a tool used by developers to build and run AI agents. A security flaw in its URL fetching tool allowed the AI to be tricked into accessing private internal network services or local files on the developer's machine. This could lead to the exposure of sensitive internal data or cloud credentials if an attacker uses techniques like prompt injection to manipulate the AI's behavior.

Technologies: [Moonshot AI Kimi Code](https://junglewise.ai/threats/technologies/kimi-code). Vendors: [Moonshot AI](https://junglewise.ai/threats/vendors/moonshot-ai).

## Quick answers

**Is CVE-2026-17534 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17534 being exploited in the wild.

**How severe is CVE-2026-17534?** Medium severity, with a CVSS score of 5.5, published 27 July 2026.

**Which products and versions are affected?** Moonshot AI Kimi Code < 0.27.0.

**Is there a fix for CVE-2026-17534?** A patch was published on 2026-07-17: Fix merged and version 0.27.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17534 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-17534?** Check whether you run Moonshot AI Kimi Code at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Kimi Code (specifically the @moonshot-ai/kimi-code package) prior to version 0.27.0 implemented SSRF protections using only a static denylist of hostnames and IP literals in the assertSafeFetchTarget function. This implementation failed to resolve DNS hostnames before validation and did not re-validate targets following HTTP redirects. An attacker can bypass these protections via DNS rebinding, crafted public domains that resolve to internal IP ranges (e.g., loopback or RFC1918), or by using a public URL that redirects to an internal service. Because FetchURL is part of the default auto-approve toolset, these requests can be triggered without user intervention via prompt injection. The vulnerability is fixed in version 0.27.0 by implementing DNS resolution before validation, manual redirect following with per-hop re-validation, and connection pinning to prevent TOCTOU/DNS-rebinding attacks.

## Affected products

- MoonshotAI Kimi Code (@moonshot-ai/kimi-code) < 0.27.0

## Timeline

- 2026-07-16: disclosed: Pull request submitted to harden FetchURL SSRF protections
- 2026-07-17: patched: Fix merged and version 0.27.0 released
- 2026-07-27: advisory: CVE-2026-17534 published

## References

- [https://github.com/MoonshotAI/kimi-code](https://github.com/MoonshotAI/kimi-code)
- [https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30](https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30)
- [https://github.com/MoonshotAI/kimi-code/pull/1791](https://github.com/MoonshotAI/kimi-code/pull/1791)
- [https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0](https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0)

## Related threats

- [Moonshot AI Kimi Code reliance on untrusted input in WorkspaceDirsService](https://junglewise.ai/threats/cve-2026-126758-a-vulnerability-was-detected-in-moonshot-ai-kimi-code-up-to-2-0)
- [Moonshot AI Kimi Code open redirect in Web UI](https://junglewise.ai/threats/cve-2026-126757-a-security-vulnerability-has-been-detected-in-moonshot-ai-kimi)
- [Moonshot AI Kimi Code arbitrary command injection in MCP configuration loader](https://junglewise.ai/threats/cve-2026-95660-a-security-flaw-has-been-discovered-in-moonshot-ai-kimi-code-up)