VYPR
← All advisories
High severityGHSA Advisory· Published Jul 21, 2026· Updated Jul 23, 2026

CVE-2026-47695

CVE-2026-47695

Description

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (http.request, http.websocket) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (64:ff9b::/96). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as http://[64:ff9b::]/ instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cc.tweaked:cc-tweaked-1.21-coreMaven
< 1.119.01.119.0
cc.tweaked:cc-tweaked-1.20.1-coreMaven
< 1.119.01.119.0
cc.tweaked:cc-tweaked-1.20.4-coreMaven
< 1.119.01.119.0
cc.tweaked:cc-tweaked-1.20.5-coreMaven
< 1.119.01.119.0
cc.tweaked:cc-tweaked-1.20.6-coreMaven
< 1.119.01.119.0
cc.tweaked:cc-tweaked-1.19.3-coreMaven
< 1.119.01.119.0
cc.tweaked:cc-tweaked-1.19.4-coreMaven
< 1.119.01.119.0
cc.tweaked:cc-tweaked-1.20-coreMaven
< 1.119.01.119.0

Affected products

9

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.