CC-Tweaked has an SSRF Protection Bypass with NAT64

Summary

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as `http://[64:ff9b::<ipv4-as-hex>]/` instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue.

Timeline

1. Jul 21, 2026, 8:51 PM UTCCVE published
2. Jul 23, 2026, 2:05 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: partial

3. Jul 23, 2026, 2:05 PM UTCRecord last updated

Affected versions

• cc-tweaked CC-Tweaked

  fixed in 1.119.0

• cc.tweaked:cc-tweaked-1.21-coreMaven

  fixed in 1.119.0

• cc.tweaked:cc-tweaked-1.20.1-coreMaven

  fixed in 1.119.0

• cc.tweaked:cc-tweaked-1.20.4-coreMaven

  fixed in 1.119.0

• cc.tweaked:cc-tweaked-1.20.5-coreMaven

  fixed in 1.119.0

• cc.tweaked:cc-tweaked-1.20.6-coreMaven

  fixed in 1.119.0

• cc.tweaked:cc-tweaked-1.19.3-coreMaven

  fixed in 1.119.0

• cc.tweaked:cc-tweaked-1.19.4-coreMaven

  fixed in 1.119.0

• cc.tweaked:cc-tweaked-1.20-coreMaven

  fixed in 1.119.0

References 1