CVE-2026-55758 in CC-Tweaked
Summary
by MITRE • 08/27/2026
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the RFC 8215 64:ff9b:1::/48 local-use prefix. On a dual-stack server using RFC 8215 NAT64, an unauthenticated user who can execute Lua code can use http.request or http.websocket with an address under 64:ff9b:1::/48 to reach loopback, RFC 1918, cloud metadata, or internal API endpoints because PrivatePattern.matches() does not classify the mapped IPv6 address as private. This issue is fixed in version 1.120.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in CC: Tweaked prior to version 1.120.0 represents a significant server-side request forgery flaw rooted in an incomplete implementation of IP address validation logic within the mod's HTTP API subsystem. The core issue resides in the AddressPredicate class, which is responsible for determining whether a requested network destination should be permitted or blocked based on its classification as private or internal. While the developers correctly implemented protection against RFC 6052 NAT64 prefixes by blocking traffic destined for the 64:ff9b::/96 range, they failed to account for the broader local-use prefix defined in RFC 8215, specifically the 64:ff9b:1::/48 block. This oversight creates a critical gap in the security boundary because many modern network environments utilize NAT64 gateways that map IPv6 addresses directly to internal IPv4 loopback or private ranges without using the specific /96 prefix initially targeted by the fix.
From an operational perspective, this flaw allows any user with the ability to execute Lua code within a ComputerCraft computer on a dual-stack server to bypass security restrictions and initiate connections to sensitive internal resources. By crafting HTTP requests via http.request or WebSocket connections through http.websocket using addresses falling under the 64:ff9b:1::/48 range, an attacker can effectively reach loopback interfaces such as localhost, RFC 1918 private networks like 10.x.x.x or 192.168.x.x, and cloud metadata endpoints that provide instance identity credentials and configuration data. The underlying PrivatePattern.matches() method fails to recognize these mapped IPv6 addresses as private because it relies on a static list of prefixes that does not include the RFC 8215 local-use block, thereby treating them as public internet destinations eligible for outbound connection attempts.
The impact of this vulnerability is severe in environments where CC: Tweaked computers are accessible by untrusted users or players who have been granted code execution privileges but should be restricted from accessing backend infrastructure. An attacker can leverage this flaw to perform server-side request forgery attacks against internal APIs, exfiltrate sensitive data from cloud metadata services such as AWS EC2 instance metadata or Azure managed identity endpoints, and potentially pivot further into the network by probing other internal services exposed through NAT64 gateways. This aligns with CWE-918 Server-Side Request Forgery (SSRF) where the server acts as a proxy for malicious requests to restricted resources due to insufficient validation of destination addresses.
To mitigate this risk, administrators must upgrade CC: Tweaked to version 1.120.0 or later, which includes the corrected AddressPredicate logic that properly classifies RFC 8215 NAT64 prefixes as private and blocks them appropriately. In addition to upgrading, it is advisable to implement network-level controls such as firewall rules that restrict outbound traffic from game servers to only necessary external endpoints, thereby providing a defense-in-depth strategy against SSRF attempts regardless of application-layer vulnerabilities. Security practitioners should also review other mod components for similar hardcoding issues regarding IP address classification standards and ensure that all IPv6 prefixes associated with private or reserved ranges are explicitly handled in validation logic to prevent bypasses through alternative addressing schemes. This incident highlights the importance of comprehensive coverage when implementing security filters against network-based attacks, particularly those involving complex networking protocols like NAT64 which map internal addresses into global routing spaces.