CVE-2026-47695

HighCVSS 7.1

Published: 21/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Vulnerability in CC: Tweaked mod for Minecraft. Prior to version 1.119.0, the HTTP API blocks requests to private network ranges to prevent SSRF. This protection can be bypassed on IPv6-capable servers using NAT64 prefix addresses (`64:ff9b::/96`). An attacker executing Lua code can reach internal IPv4 services by addressing them as `http://[64:ff9b::<ipv4-as-hex>]/`. Affects deployments on networks with NAT64 routing, standard on AWS, GCP, etc. Version 1.119.0 fixes the issue.

Risk Assessment

Risk involves bypassing SSRF protection and accessing internal IPv4 services by an attacker executing Lua code, potentially leading to data leakage or further attacks.

Recommendation

Immediately update CC: Tweaked mod to version 1.119.0 or later.

Other vulnerabilities in CC: Tweaked

CVE-2026-55758Medium
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the RFC 8215 64:ff9b:1::/48 local-use prefix. On a dual-stack server using RFC 8215 NAT64, an unauthenticated user who can execute Lua code can use http.request or http.websocket with an address under 64:ff9b:1::/48 to reach loopback, RFC 1918, cloud metadata, or internal API endpoints because PrivatePattern.matches() does not classify the mapped IPv6 address as private.

Original NVD description (English source)

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as `http://[64:ff9b::<ipv4-as-hex>]/` instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue.