{"slug": "kimi-code-is-vulnerable-to-a-fetchurl-ssrf-protection-bypass-via-dns-resolving", "title": "Kimi Code is vulnerable to a FetchURL SSRF Protection Bypass via DNS-resolving Hostnames and Redirects", "summary": "Moonshot AI's Kimi Code, a coding agent, is vulnerable to a FetchURL SSRF protection bypass in versions before 0.27.0, allowing attackers to reach internal network services via DNS-resolving hostnames or redirects. The flaw stems from a static denylist that fails to resolve DNS or revalidate after redirects, and FetchURL is in the default auto-approve tool set. The fix in version 0.27.0 adds DNS resolution, per-hop redirect validation, and connection pinning.", "body_md": "[Summary](#summary)\n\nKimi Code is vulnerable to a FetchURL SSRF Protection Bypass via DNS-resolving Hostnames and Redirects\n\n[Component](#component)\n\n@moonshot-ai/kimi-code (Kimi Code)\n\n[Affected versions](#affected-versions)\n\n< 0.27.0\n\n[Description](#description)\n\nKimi Code implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call, for example via prompt injection, can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.\n\n[PoC](#poc)\n\n**Step 1 - Start a local HTTP listener**\n\n`python3 -m http.server 1337 --bind 127.0.0.1`\n\n**Step 2 - Confirm the literal denylist blocks localhost**\n\nAsk the agent to use FetchURL on `http://localhost:1337`\n\n(or `http://127.0.0.1:1337`\n\n).\n\nExpected result: the request is denied by assertSafeFetchTarget (for example, \"Refusing to fetch private host\").\n\n**Step 3 - Bypass via a DNS-resolving hostname**\n\nAsk the agent to use FetchURL on a public hostname whose DNS resolves to loopback, for example `http://localtest.me:1337`\n\n.\n\n**Step 4 - Verify the request reaches the local listener**\n\nWatch the simple HTTP server console. A GET request arrives from the Kimi Code process, demonstrating that DNS-resolving names are not validated against private address ranges.\n\nThe same class of bypass applies to public URLs that HTTP-redirect to loopback or internal targets, because redirects were followed without re-running the safety check on each hop.\n\n[Vulnerability Mitigations](#vulnerability-mitigations)\n\nUpgrade to Kimi Code 0.27.0 or later. The fix resolves hostnames via DNS and rejects addresses in loopback, RFC1918, link-local, CGNAT, and ULA ranges; follows redirects manually with per-hop revalidation; and pins connections to the validated resolved addresses to reduce DNS-rebinding (TOCTOU) races.\n\n[References](#references)\n\n[https://github.com/MoonshotAI/kimi-code/pull/1791](https://github.com/MoonshotAI/kimi-code/pull/1791)\n[https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30](https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30)\n[https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0](https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0)", "url": "https://wpnews.pro/news/kimi-code-is-vulnerable-to-a-fetchurl-ssrf-protection-bypass-via-dns-resolving", "canonical_source": "https://research.jfrog.com/vulnerabilities/kimi-code-is-vulnerable-to-a-fetchurl-ssrf-protection-bypass-via-dns-resolving-hostnames-and-redirects-cve-2026-17534/", "published_at": "2026-07-27 00:00:00+00:00", "updated_at": "2026-08-03 12:18:04.153183+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "developer-tools"], "entities": ["Moonshot AI", "Kimi Code", "FetchURL"], "alternates": {"html": "https://wpnews.pro/news/kimi-code-is-vulnerable-to-a-fetchurl-ssrf-protection-bypass-via-dns-resolving", "markdown": "https://wpnews.pro/news/kimi-code-is-vulnerable-to-a-fetchurl-ssrf-protection-bypass-via-dns-resolving.md", "text": "https://wpnews.pro/news/kimi-code-is-vulnerable-to-a-fetchurl-ssrf-protection-bypass-via-dns-resolving.txt", "jsonld": "https://wpnews.pro/news/kimi-code-is-vulnerable-to-a-fetchurl-ssrf-protection-bypass-via-dns-resolving.jsonld"}}