CVE-2026-47695: CC: Tweaked Minecraft Mod SSRF Vulnerability

CVE-2026-47695 Overview

CVE-2026-47695 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in CC: Tweaked, a Minecraft mod that adds programmable in-game computers and turtles. The mod's HTTP API (http.request and http.websocket) enforces a blocklist against private IPv4 ranges to prevent internal network access. Attackers bypass this filter by encoding target IPv4 addresses inside the NAT64 well-known prefix 64:ff9b::/96. On IPv6-capable hosts with NAT64 routing, the mod resolves and reaches internal IPv4 services through the IPv6 address. Version 1.119.0 fixes the issue.

Critical Impact
Any player able to run Lua code on the server can reach internal IPv4 services, including cloud metadata endpoints on AWS and GCP IPv6-only subnets where NAT64 routing is standard.

Affected Products

CC: Tweaked versions prior to 1.119.0
Minecraft servers running CC: Tweaked on IPv6-capable hosts
Deployments on cloud platforms with NAT64 routing (AWS, GCP IPv6-only subnets)

Discovery Timeline

2026-07-21 - CVE-2026-47695 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47695

Vulnerability Analysis

CC: Tweaked exposes an in-game HTTP client to Lua scripts running on virtual computers. To prevent players from probing the host network, the mod filters outbound requests against a blocklist of private IPv4 ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and cloud metadata addresses like 169.254.169.254. The filter evaluates the resolved destination as an IPv4 address. It does not recognize that an IPv6 address inside the NAT64 well-known prefix 64:ff9b::/96 will be translated by the network stack into the embedded IPv4 address.

An attacker with Lua execution rights encodes the target IPv4 into the low 32 bits of an IPv6 literal. The request http.request("http://[64:ff9b::a9fe:a9fe]/latest/meta-data/") reaches 169.254.169.254 after NAT64 translation. This bypasses SSRF protections and grants access to cloud instance metadata, internal APIs, and administrative interfaces.

Root Cause

The blocklist operates on IPv4 literals and standard IPv6 private ranges but omits the NAT64 well-known prefix defined in RFC 6052. Addresses in 64:ff9b::/96 are globally routable IPv6 addresses that map to IPv4 destinations at the network layer. The filter treats them as arbitrary public IPv6 targets and permits the request.

Attack Vector

Exploitation requires the ability to execute Lua on a CC: Tweaked computer, which any player with a computer block can do on a default server. The attacker constructs an IPv6 URL where the last 32 bits encode the internal IPv4 address in hexadecimal. Impact scales with what the host network exposes to internal callers, including cloud metadata services that can return temporary IAM credentials.

See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-47695

Indicators of Compromise

Outbound HTTP or WebSocket requests from the Minecraft server process to destinations in the 64:ff9b::/96 prefix.
CC: Tweaked HTTP API log entries containing IPv6 literals with embedded IPv4 hex values such as a9fe:a9fe, ac10:*, or c0a8:*.
Unexpected access to cloud instance metadata endpoints originating from the Minecraft server.

Detection Strategies

Inspect CC: Tweaked HTTP API logs for requests targeting IPv6 addresses beginning with 64:ff9b:.
Monitor DNS and connection logs on the host for NAT64 translations initiated by the Java process running the Minecraft server.
Correlate Lua script uploads or http.request invocations with subsequent outbound traffic to metadata service ranges.

Monitoring Recommendations

Alert on any egress from Minecraft server workloads to 169.254.169.254, fd00:ec2::254, or metadata.google.internal.
Baseline outbound HTTP destinations from game server hosts and flag deviations to internal RFC1918 or link-local ranges.
Enable audit logging on CC: Tweaked and forward events to a centralized data lake for retention and query.

How to Mitigate CVE-2026-47695

Immediate Actions Required

Upgrade CC: Tweaked to version 1.119.0 or later on every Minecraft server that runs the mod.
Restrict IMDSv1 and enforce IMDSv2 with hop-limit 1 on AWS instances hosting the server.
Remove or lock down the http API in cc-tweaked-server.toml if the mod cannot be upgraded immediately.

Patch Information

CC: Tweaked version 1.119.0 extends the HTTP request filter to reject IPv6 destinations within the NAT64 well-known prefix 64:ff9b::/96 and other IPv4-mapped or translated address forms. Refer to the GitHub Security Advisory GHSA-5jh9-2h63-pw4q for the fixed release.

Workarounds

Disable the HTTP API by setting http.enabled = false in the CC: Tweaked configuration until the patch is deployed.
Deploy the Minecraft server on an IPv4-only host or disable IPv6 on the network interface to prevent NAT64 routing.
Add an egress firewall rule that blocks the game server from reaching 64:ff9b::/96 and internal IPv4 ranges.

bash

# Configuration example: disable the HTTP API in cc-tweaked-server.toml
[http]
enabled = false

# Or block NAT64 egress with ip6tables
ip6tables -A OUTPUT -d 64:ff9b::/96 -j REJECT