CVE-2026-47695: 
Java vulnerability analysis and mitigation

CVE-2026-47695 is a Server-Side Request Forgery (SSRF) protection bypass vulnerability in CC-Tweaked, a Minecraft mod that adds programmable computers. The flaw allows attackers who can execute Lua code to bypass the HTTP API's private network blocklist by using NAT64 well-known prefix addresses (64:ff9b::/96), reaching internal IPv4 services that should be blocked. It affects all cc.tweaked:cc-tweaked-*-core Maven packages prior to version 1.119.0, covering Minecraft versions 1.19.3 through 1.21. First published by SquidDev on May 18, 2026, and added to the GitHub Advisory Database on May 29, 2026, it carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the IP filter in PrivatePattern.matches() within AddressPredicate.java relies exclusively on Java's built-in InetAddress classification methods (isLoopbackAddress(), isSiteLocalAddress(), etc.), none of which recognize the NAT64 well-known prefix 64:ff9b::/96 (defined in RFC 6052). When an attacker supplies a NAT64-encoded IPv4 address (e.g., 64:ff9b::c0a8:0101 for 192.168.1.1), Java resolves it as an Inet6Address, all filter checks return false, and CC-Tweaked opens the connection. On networks with a 64:ff9b::/96 → NAT Gateway route — standard on AWS and GCP IPv6-only subnets — the NAT gateway translates the connection back to the embedded IPv4 address, forwarding it to the internal service. The existing 6to4 (2002::/16) mitigation in AddressRule.java does not cover this prefix, and the vulnerability does not appear to be exploitable on modern macOS (GitHub Advisory, CC-Tweaked Advisory).

Successful exploitation allows any player or user able to run Lua code on a CC-Tweaked in-game computer — including untrusted players on public Minecraft servers — to send HTTP requests to internal IPv4 services that the SSRF filter is designed to block. On cloud-hosted servers (AWS, GCP, Azure) using IPv6-only subnets with NAT64, which has become increasingly common following AWS's February 2024 public IPv4 pricing change, reachable targets include other VPC instances, internal databases, and cloud instance metadata APIs (e.g., 169.254.169.254). The subsequent system impact is rated High for confidentiality, integrity, and availability, meaning attackers could exfiltrate credentials, tamper with internal services, or disrupt cloud infrastructure (GitHub Advisory).

1. Identify a vulnerable target: Locate a public or accessible Minecraft server running CC-Tweaked version prior to 1.119.0 on a cloud platform (AWS, GCP, Azure) with an IPv6-only subnet and NAT64 routing (64:ff9b::/96 → NAT Gateway).
2. Gain Lua code execution: Join the server and access a CC-Tweaked in-game computer, or use any existing mechanism that allows running Lua scripts (e.g., open computer terminals).
3. Identify internal target: Determine the IPv4 address of an internal service to reach (e.g., the cloud metadata API at 169.254.169.254, or an internal service at 10.0.1.17:8888).
4. Convert IPv4 to NAT64 address: Apply the conversion formula — for IPv4 a.b.c.d, compute 64:ff9b::<hex(a.b)>:<hex(c.d)>. For example, 10.0.1.17 (hex 0a 00 01 11) becomes 64:ff9b::0a00:0111.
5. Send the crafted HTTP request: Execute the following Lua payload on the in-game computer:

-- 10.0.1.17 = 0x0a000111, expressed as NAT64: 64:ff9b::0a00:0111
local res = http.request("http://[64:ff9b::0a00:0111]:8888/")
if res then print(res.readAll()) end

6. Receive internal response: The NAT gateway translates the IPv6 NAT64 address back to the target IPv4 address; the internal service responds and the attacker reads the output directly in-game, potentially obtaining credentials, metadata tokens, or sensitive data (GitHub Advisory, CC-Tweaked Advisory).

• Network: Outbound HTTP/HTTPS connections from the Minecraft server process to IPv6 addresses in the 64:ff9b::/96 range; unexpected TCP connections from the server to internal IPv4 addresses (e.g., 169.254.169.254, RFC 1918 ranges) originating from the NAT gateway.
• Logs: Minecraft/CC-Tweaked server logs showing http.request or http.websocket calls to URLs containing [64:ff9b:: prefixes; Java network logs recording Inet6Address connections to the 64:ff9b::/96 subnet.
• Cloud Audit Logs: AWS CloudTrail or GCP Audit Logs showing unexpected API calls to instance metadata endpoints (169.254.169.254) or internal services, originating from the Minecraft server's IP; NAT gateway flow logs showing translated connections from 64:ff9b::/96 to internal RFC 1918 addresses.

Upgrade to CC-Tweaked version 1.119.0 or later, which patches the vulnerability across all supported Minecraft versions (1.19.3 through 1.21). The fix involves adding an explicit check for the NAT64 well-known prefix (64:ff9b::/96) in PrivatePattern.matches() within AddressPredicate.java. As a network-level workaround, administrators can remove or restrict the 64:ff9b::/96 → NAT Gateway route table entry on the server's subnet, though this may impact legitimate IPv4 connectivity on IPv6-only networks. Server operators who cannot immediately upgrade should consider disabling the CC-Tweaked HTTP API entirely or restricting which players can execute Lua code (GitHub Advisory, CC-Tweaked Advisory).