CVE-2026-17534: Kimi Code FetchURL SSRF through DNS resolution and redirects

Summary

Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 applies SSRF hardening to FetchURL using a static hostname and IP-literal denylist in assertSafeFetchTarget, without DNS resolution or re-validation after HTTP redirects. An attacker who can influence a FetchURL call, for example through prompt injection, can use a crafted public hostname or a redirecting public URL to reach loopback or other internal addresses. FetchURL is in the default auto-approve tool set, so manual mode does not require user confirmation for the call.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)