The blast in the early evening struck a crowded passenger bus as it drove through the city center.
There was no immediate claim of responsibility, although Daesh terrorists are active in the area.
In December 2017, Iraq declared victory over the group, which once controlled large swathes of the country. But Daesh has since switched to hit-and-run attacks aimed at undermining the Baghdad government.
Its fighters have regrouped in the Hemrin mountain range in the northeast, which extends from Diyala province on the border with Iran across northern Salahuddin province and into southern Kirkuk.
On Tuesday, four Iraqi federal policemen were killed after a bomb went off southwest of Kirkuk, two security sources told Reuters. It followed an attack on Monday on a village 65 km (40 miles) southwest of Kirkuk, which killed three residents.