# Kimi Code is vulnerable to a FetchURL SSRF Protection Bypass via DNS-resolving Hostnames and Redirects

> Source: <https://research.jfrog.com/vulnerabilities/kimi-code-is-vulnerable-to-a-fetchurl-ssrf-protection-bypass-via-dns-resolving-hostnames-and-redirects-cve-2026-17534/>
> Published: 2026-07-27 00:00:00+00:00

[Summary](#summary)

Kimi Code is vulnerable to a FetchURL SSRF Protection Bypass via DNS-resolving Hostnames and Redirects

[Component](#component)

@moonshot-ai/kimi-code (Kimi Code)

[Affected versions](#affected-versions)

< 0.27.0

[Description](#description)

Kimi Code implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call, for example via prompt injection, can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.

[PoC](#poc)

**Step 1 - Start a local HTTP listener**

`python3 -m http.server 1337 --bind 127.0.0.1`

**Step 2 - Confirm the literal denylist blocks localhost**

Ask the agent to use FetchURL on `http://localhost:1337`

(or `http://127.0.0.1:1337`

).

Expected result: the request is denied by assertSafeFetchTarget (for example, "Refusing to fetch private host").

**Step 3 - Bypass via a DNS-resolving hostname**

Ask the agent to use FetchURL on a public hostname whose DNS resolves to loopback, for example `http://localtest.me:1337`

.

**Step 4 - Verify the request reaches the local listener**

Watch the simple HTTP server console. A GET request arrives from the Kimi Code process, demonstrating that DNS-resolving names are not validated against private address ranges.

The same class of bypass applies to public URLs that HTTP-redirect to loopback or internal targets, because redirects were followed without re-running the safety check on each hop.

[Vulnerability Mitigations](#vulnerability-mitigations)

Upgrade to Kimi Code 0.27.0 or later. The fix resolves hostnames via DNS and rejects addresses in loopback, RFC1918, link-local, CGNAT, and ULA ranges; follows redirects manually with per-hop revalidation; and pins connections to the validated resolved addresses to reduce DNS-rebinding (TOCTOU) races.

[References](#references)

[https://github.com/MoonshotAI/kimi-code/pull/1791](https://github.com/MoonshotAI/kimi-code/pull/1791)
[https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30](https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30)
[https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0](https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0)