The car was parked in front of the Blue Sky restaurant, near a busy road close to the headquarters of the Somali National Intelligence and Security Agency (NISA) in a southern district of the city.
The blast was detonated remotely outside the restaurant, security forces spokesman Mohamed Dahir told AFP, adding that "information we have gotten so far indicates that two civilians were killed in the blast".
Sources said the restaurant is frequented both by security personnel and civilians.
There was no immediate claim of responsibility although immediate suspicion fell on the Al-Qaeda linked Islamist group Shabaab, locked in battle against the Somali government and which regularly mounts attacks in the city.
Despite being driven out of the capital in 2011 by an African Union force deployed in 2007 the group still control vast swathes of outlying rural areas from which they launch guerrilla operations.