The attack took place at the Dayah hotel, where some members of parliament were thought to be staying, police said on Wednesday.
Somali security minister Abdirizak Omar Mohamed said the four attackers had been killed by security forces.
The Islamist militant group al-Shabab has said it carried out the attack.
Ambulance workers say they have counted 28 bodies in the hotel and a further 43 people are injured – including seven journalists – although there is no official confirmation of this figure.
Eyewitnesses said the attackers had used a vehicle laden with explosives to blast their way into the hotel and once inside they started shooting.
Shortly after the first blast, another vehicle exploded, killing and wounding more people who had gathered in the area.
Survivors described how hotel residents hid under beds and others jumped out of windows to escape the attackers.
Hassan Nur told the AP news agency: “They [the gunman] kicked down room doors and at some point posed themselves as rescue teams by telling those inside to come out, (only) to kill them.”
Police officer Colonel Abdiqadir Hussein told Reuters that security forces had later managed to secure the building.
“We have rescued the people and concluded the operation at Dayah hotel,” he said.
“The security forces are now inside the hotel.”
The hotel is located less than a mile from Somalia’s presidential palace and is popular with dignitaries.
The attack comes at a time when the country is preparing for indirect elections where MPs are set to choose a president.