What happened
NVD published CVE-2026-17534 (CVSS 5.5, Medium) on 2026-07-27. Kimi Code is Moonshot AI's agentic coding CLI tool; its FetchURL tool's SSRF protection checks the hostname/IP literal before the request but does not re-check after DNS resolution or HTTP redirects, allowing bypass via DNS rebinding or redirect chains.
Why it matters
Kimi Code is an actively-used AI coding agent from a major Chinese frontier AI lab (Moonshot AI, maker of Kimi K2/K3). A prompt-injection-driven SSRF in its fetch tool could let an attacker pivot an agentic session into scanning or reaching internal infrastructure/cloud metadata from wherever the coding agent runs — a classic agent-tool confused-deputy pattern with a widely-distributed AI coding tool.
Attack vector
Kimi Code's assertSafeFetchTarget SSRF hardening is implemented as a static hostname/IP-literal denylist without resolving DNS or re-validating the host after HTTP redirects. An attacker who can influence a FetchURL call — for example via prompt injection embedded in content the agent processes — can supply a hostname that resolves (or redirects) to an internal/private address post-check, bypassing the SSRF guard and reaching internal network resources or cloud metadata endpoints.
Affected systems
@moonshot-ai/kimi-code before 0.27.0
Mitigation
Upgrade to Kimi Code 0.27.0 or later, which is expected to add DNS-resolution and post-redirect re-validation to the fetch-target guard.