CVE-2026-55758: CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the RFC 8215 64:ff9b:1::/48 local-use prefix. On a dual-stack server using RFC 8215 NAT64, an unauthenticated user who can execute Lua code can use http.request or http.websocket with an address under 64:ff9b:1::/48 to reach loopback, RFC 1918, cloud metadata, or internal API endpoints because PrivatePattern.matches() does not classify the mapped IPv6 address as private. This issue is fixed in version 1.120.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tweakedto a version that resolves this vulnerability.Fixed in 1.120.0
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Deployments running CC: Tweaked before version 1.120.0 are exposed if the Minecraft server is dual-stack and uses RFC 8215 NAT64. The relevant local-use NAT64 prefix is 64:ff9b:1::/48.
What does an attacker need to exploit this issue?
An attacker does not need authentication, but must be able to execute Lua code in CC: Tweaked. They can invoke http.request or http.websocket using an address mapped through the 64:ff9b:1::/48 prefix.
What internal resources could be reached?
The bypass can allow requests to loopback services, RFC 1918 private addresses, cloud metadata endpoints, and internal APIs. This occurs because the mapped IPv6 address is not classified as private by the affected SSRF protection.
What version fixes the issue?
Upgrade CC: Tweaked to version 1.120.0, which includes the fix for the omitted RFC 8215 NAT64 local-use prefix.