CVE-2026-47695

Received Received - Intake

CC-Tweaked IPv6 NAT64 SSRF Bypass Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as `http://[64:ff9b::<ipv4-as-hex>]/` instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-47695

Affected Vendors & Products

Vendor	Product	Version / Range
cc_tweaked	cc_tweaked	to 1.119.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CC: Tweaked is a Minecraft mod that adds programmable computers. Prior to version 1.119.0, it blocked requests to private networks to prevent SSRF attacks. However, IPv6-capable servers using NAT64 well-known prefix addresses (64:ff9b::/96) could bypass this protection. Attackers could exploit this by crafting requests to internal IPv4 services via IPv6 addresses, affecting deployments on networks with NAT64 routing like AWS or GCP.

Detection Guidance

To detect this vulnerability, check if your CC-Tweaked deployment is running on a network with NAT64 routing. Verify if the server supports IPv6 and if NAT64 is configured. Inspect network configurations for IPv6-only subnets or NAT64 prefixes like 64:ff9b::/96.

Impact Analysis

If you run a CC: Tweaked server on a network with NAT64 routing (common on AWS/GCP with IPv6-only subnets), an attacker could execute Lua code to access internal IPv4 services that should be blocked. This could lead to unauthorized access to sensitive services or data on your network.

Mitigation Strategies

Upgrade CC-Tweaked to version 1.119.0 or later to address the SSRF bypass issue. If upgrading is not immediately possible, restrict access to the HTTP API or disable Lua code execution in untrusted environments.

Hi! I’m here to help you understand CVE-2026-47695. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70