Read the docs
TI-2026-35199 Aliases CVE-2026-47695GHSA-5jh9-2h63-pw4q

CC-Tweaked has an SSRF Protection Bypass with NAT64

Priority MEDIUM 64CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as `http://[64:ff9b::<ipv4-as-hex>]/` instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00468 40th percentileScored 2026-11-07
Fix Fixed CC-Tweaked (cc-tweaked): 1.119.0cc.tweaked:cc-tweaked-1.21-core (Maven): 1.119.0+7 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cc-tweakedCC-Tweakedbefore 1.119.01.119.0Patch availableCNA
—cc.tweaked:cc-tweaked-1.21-core (Maven)before 1.119.01.119.0Patch availableGHSA-5jh9-2h63-pw4q
—cc.tweaked:cc-tweaked-1.20.1-core (Maven)before 1.119.01.119.0Patch availableGHSA-5jh9-2h63-pw4q
—cc.tweaked:cc-tweaked-1.20.4-core (Maven)before 1.119.01.119.0Patch availableGHSA-5jh9-2h63-pw4q
—cc.tweaked:cc-tweaked-1.20.5-core (Maven)before 1.119.01.119.0Patch availableGHSA-5jh9-2h63-pw4q
—cc.tweaked:cc-tweaked-1.20.6-core (Maven)before 1.119.01.119.0Patch availableGHSA-5jh9-2h63-pw4q
—cc.tweaked:cc-tweaked-1.19.3-core (Maven)before 1.119.01.119.0Patch availableGHSA-5jh9-2h63-pw4q
—cc.tweaked:cc-tweaked-1.19.4-core (Maven)before 1.119.01.119.0Patch availableGHSA-5jh9-2h63-pw4q
—cc.tweaked:cc-tweaked-1.20-core (Maven)before 1.119.01.119.0Patch availableGHSA-5jh9-2h63-pw4q
  • CC-Tweaked Vendorcc-tweaked Affected before 1.119.0 Fixed in 1.119.0 Patch available CNA
  • cc.tweaked:cc-tweaked-1.21-core (Maven) Vendor— Affected before 1.119.0 Fixed in 1.119.0 Patch available GHSA-5jh9-2h63-pw4q
  • cc.tweaked:cc-tweaked-1.20.1-core (Maven) Vendor— Affected before 1.119.0 Fixed in 1.119.0 Patch available GHSA-5jh9-2h63-pw4q
  • cc.tweaked:cc-tweaked-1.20.4-core (Maven) Vendor— Affected before 1.119.0 Fixed in 1.119.0 Patch available GHSA-5jh9-2h63-pw4q
  • cc.tweaked:cc-tweaked-1.20.5-core (Maven) Vendor— Affected before 1.119.0 Fixed in 1.119.0 Patch available GHSA-5jh9-2h63-pw4q
  • cc.tweaked:cc-tweaked-1.20.6-core (Maven) Vendor— Affected before 1.119.0 Fixed in 1.119.0 Patch available GHSA-5jh9-2h63-pw4q
  • cc.tweaked:cc-tweaked-1.19.3-core (Maven) Vendor— Affected before 1.119.0 Fixed in 1.119.0 Patch available GHSA-5jh9-2h63-pw4q
  • cc.tweaked:cc-tweaked-1.19.4-core (Maven) Vendor— Affected before 1.119.0 Fixed in 1.119.0 Patch available GHSA-5jh9-2h63-pw4q
  • cc.tweaked:cc-tweaked-1.20-core (Maven) Vendor— Affected before 1.119.0 Fixed in 1.119.0 Patch available GHSA-5jh9-2h63-pw4q

Remediation

  • Fix · CNA CC-Tweaked (cc-tweaked) Fixed in 1.119.0
  • Fix · GHSA-5jh9-2h63-pw4q cc.tweaked:cc-tweaked-1.21-core (Maven) Fixed in 1.119.0 Advisory →
  • Fix · GHSA-5jh9-2h63-pw4q cc.tweaked:cc-tweaked-1.20.1-core (Maven) Fixed in 1.119.0 Advisory →
  • Fix · GHSA-5jh9-2h63-pw4q cc.tweaked:cc-tweaked-1.20.4-core (Maven) Fixed in 1.119.0 Advisory →
  • Fix · GHSA-5jh9-2h63-pw4q cc.tweaked:cc-tweaked-1.20.5-core (Maven) Fixed in 1.119.0 Advisory →
  • Fix · GHSA-5jh9-2h63-pw4q cc.tweaked:cc-tweaked-1.20.6-core (Maven) Fixed in 1.119.0 Advisory →
  • Fix · GHSA-5jh9-2h63-pw4q cc.tweaked:cc-tweaked-1.19.3-core (Maven) Fixed in 1.119.0 Advisory →
  • Fix · GHSA-5jh9-2h63-pw4q cc.tweaked:cc-tweaked-1.19.4-core (Maven) Fixed in 1.119.0 Advisory →
  • Fix · GHSA-5jh9-2h63-pw4q cc.tweaked:cc-tweaked-1.20-core (Maven) Fixed in 1.119.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47695
  2. 2026-10-03 Alias added: GHSA-5jh9-2h63-pw4q

References

Other 2

  • TI-2026-40247 CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences