CVE-2026-55758

Received Received - Intake

SSRF Bypass in CC: Tweaked via RFC 8215 NAT64

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: GitHub, Inc.

Description

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the RFC 8215 64:ff9b:1::/48 local-use prefix. On a dual-stack server using RFC 8215 NAT64, an unauthenticated user who can execute Lua code can use http.request or http.websocket with an address under 64:ff9b:1::/48 to reach loopback, RFC 1918, cloud metadata, or internal API endpoints because PrivatePattern.matches() does not classify the mapped IPv6 address as private. This issue is fixed in version 1.120.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-55758

Affected Vendors & Products

Vendor	Product	Version / Range
cc_tweaked	cc_tweaked	to 1.120.0 (exc)
cc_tweaked	cc_tweaked	1.120.0
dan200	cc_tweaked	to 1.120.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-55758 is a Server-Side Request Forgery (SSRF) vulnerability in CC: Tweaked versions before 1.120.0. It occurs because the SSRF protection in AddressPredicate.java blocks the RFC 6052 NAT64 prefix but misses the RFC 8215 local-use prefix (64:ff9b:1::/48). This allows unauthenticated users executing Lua code to bypass SSRF protections by encoding private IPv4 addresses in the RFC 8215 format, reaching internal services like loopback or RFC 1918 addresses.

Detection Guidance

Check if your CC-Tweaked server version is 1.119.0 or earlier. Inspect network traffic for outbound requests to RFC 8215 NAT64 prefixes (64:ff9b:1::/48). Use packet inspection tools like tcpdump or Wireshark to monitor for encoded IPv4 addresses in IPv6 format targeting internal services.

Impact Analysis

An attacker could exploit this to send requests to internal IPv4 services that should be blocked, potentially accessing sensitive data or internal APIs. This could lead to unauthorized information disclosure or further network compromise, especially on dual-stack IPv6 servers with RFC 8215 NAT64 enabled.

Compliance Impact

This vulnerability could lead to unauthorized access to internal services, potentially exposing sensitive data. For GDPR, this may result in violations of data protection principles if personal data is accessed. For HIPAA, it could compromise protected health information if internal API endpoints are reached. The SSRF flaw allows bypassing network protections, increasing the risk of data breaches.

Mitigation Strategies

Upgrade CC-Tweaked to version 1.120.0 or later. Ensure SSRF protections include RFC 8215 prefixes (64:ff9b:1::/48) in blocklists. Disable RFC 8215 NAT64 if not required. Monitor for unauthorized outbound requests to internal endpoints.

Hi! I’m here to help you understand CVE-2026-55758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70