CVE-2026-126758

Kimi Code trusted workspace configuration before checking the project

Moonshot AI · Kimi Code workspace configuration

First documented disclosure · Review checkpoint

Summary

The workspace directory service used project-local settings in its trust decision. The agent's file-access boundary could change before project trust was established.

Severity and exploitation evidence

Medium · 4.8/10 · CVSS 4.0. Severity source.

Exploitation not established: The CNA reports that a demonstration is public. It does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The workspace directory service used project-local settings in its trust decision.

Conditions required

A local user worked with a project whose configuration they did not trust.

Potential impact

The agent's file-access boundary could change before project trust was established.

Affected versions and configurations

The CNA lists 2.0.0 through 2.0.2.

Fix and mitigation status

2.1.0. The September 23 release notes document the trust change.

Practical next steps

Update to 2.1.0 or later and review trusted working directories.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

Moonshot documented the workspace-trust change in its September 23 release. The CNA issued its separate advisory on November 11. The public disclosure was on 2026-09-23. The CVE record was published on 2026-11-11.

Sources