Kimi Code FetchURL SSRF via Incomplete Denylist and Redirect Bypass
First seen Jul 27, 2026 · Updated Jul 27, 2026 · CVSS 5.5
Kimi Code's FetchURL tool uses a static hostname/IP denylist to prevent server-side request forgery, but it never resolves DNS or re-checks the target after HTTP redirects, so an attacker can trick the agent into fetching internal resources anyway. Because FetchURL is auto-approved by default, an attacker who controls or injects content into the agent's context (e.g., via prompt injection) can trigger this without any user confirmation. This effectively turns a hardened-looking safety control into a bypassable one, exposing internal network services to the LLM agent's network position.
Technical Analysis
The vulnerability lies in assertSafeFetchTarget, which checks the literal hostname or IP string against a denylist but does not perform DNS resolution before the request nor re-validate the destination after a redirect. An attacker with the ability to influence a FetchURL call's target argument—most plausibly via prompt injection from a malicious webpage, document, or tool response consumed by the agent—can supply a public-looking hostname that resolves to 127.0.0.1 or another internal address, or a public URL that 302s to an internal target, bypassing the static check entirely. Because FetchURL sits in the default auto-approve tool set, this crosses the human-in-the-loop boundary: no interactive confirmation is required, so the SSRF fires as soon as the agent's planner decides to call the tool. The attacker gains network-level access to internal services reachable from the agent's execution environment (cloud metadata endpoints, internal admin panels, other localhost services), which can lead to credential theft, internal reconnaissance, or further lateral pivoting depending on what is reachable.
Affected Systems
Kimi Code (@moonshot-ai/kimi-code) before 0.27.0
Detection Signatures
- Outbound FetchURL/HTTP requests from the agent host to loopback (127.0.0.1, ::1), link-local (169.254.0.0/16), or RFC1918 ranges immediately following a public-hostname fetch
- HTTP responses containing 3xx redirects whose Location header points to internal/loopback addresses, followed by agent-initiated follow-up requests
- Tool call logs showing FetchURL invoked with hostnames that resolve differently at request time than at approval time (DNS rebinding pattern)
- Auto-approved tool executions with no corresponding user confirmation event in session logs
- Repeated FetchURL calls with unusual TTL DNS records or hostnames using uncommon TLDs/subdomains crafted to alias internal IPs
Remediation Steps
- 1
Upgrade Kimi Code
Update to @moonshot-ai/kimi-code 0.27.0 or later, which should include the fix for this SSRF hardening gap.
- 2
Resolve-then-validate networking
Ensure any URL fetch capability resolves DNS first and validates the resulting IP against the denylist/allowlist immediately before establishing the connection, using the same socket to prevent TOCTOU/rebinding.
- 3
Re-validate on redirect
Disable automatic redirect following in the HTTP client, or re-apply full SSRF validation (DNS resolution + IP check) on every redirect hop before following it.
- 4
Remove FetchURL from auto-approve set
Require explicit user confirmation for network fetch tools, especially when the target URL originates from untrusted or agent-generated content rather than direct user input.
- 5
Network egress controls
Deploy network-layer defenses (egress firewall rules, proxy allowlists) independent of application logic to block agent processes from reaching loopback, link-local, and internal RFC1918 ranges regardless of application-level checks.
- 6
Prompt injection hardening
Sanitize and constrain what external content can influence tool-call parameters, and treat any URL sourced from fetched web content as untrusted input requiring re-validation.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.