Threat Investigation
Request a demo

CVE-2026-47695

High

Description

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as `http://[64:ff9b::<ipv4-as-hex>]/` instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue.

SeverityHigh
CVSS7.1
Exploit probability—
ProductCc.tweaked:cc-tweaked-1.21-core
PublishedJul 21, 2026
First seenJul 21, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update
  • cc.tweaked:cc-tweaked-1.21-core1.119.0 or later
  • cc.tweaked:cc-tweaked-1.20.1-core1.119.0 or later
  • cc.tweaked:cc-tweaked-1.20.4-core1.119.0 or later
  • cc.tweaked:cc-tweaked-1.20.5-core1.119.0 or later
  • cc.tweaked:cc-tweaked-1.20.6-core1.119.0 or later
  • cc.tweaked:cc-tweaked-1.19.3-core1.119.0 or later
  • cc.tweaked:cc-tweaked-1.19.4-core1.119.0 or later
  • cc.tweaked:cc-tweaked-1.20-core1.119.0 or later

Affected products

ProductAffected versionsFixed in
cc.tweaked:cc-tweaked-1.21-coreMavenv < 1.119.01.119.0
cc.tweaked:cc-tweaked-1.20.1-coreMavenv < 1.119.01.119.0
cc.tweaked:cc-tweaked-1.20.4-coreMavenv < 1.119.01.119.0
cc.tweaked:cc-tweaked-1.20.5-coreMavenv < 1.119.01.119.0
cc.tweaked:cc-tweaked-1.20.6-coreMavenv < 1.119.01.119.0
cc.tweaked:cc-tweaked-1.19.3-coreMavenv < 1.119.01.119.0
cc.tweaked:cc-tweaked-1.19.4-coreMavenv < 1.119.01.119.0
cc.tweaked:cc-tweaked-1.20-coreMavenv < 1.119.01.119.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.