WaratekVRT Sign in

CVE-2026-47695

Severity7.1 High CVSS 4.0
Fixed in1.119.0
WeaknessServer-side request forgery (CWE-918)
Published21 Jul 2026
Updated23 Jul 2026

Description

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (http.request, http.websocket) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (64:ff9b::/96). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as http://[64:ff9b::<ipv4-as-hex>]/ instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue.

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: no, technical impact: partial.
  • Indexed PoC none indexed
  • EPSS 0.47% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by An OSV.dev record of this CVE affecting a package published to Maven Central. When every such package is one business applications do not use (Minecraft mods and launchers, Fastjson) and no tracked product is named by CPE, it settles the CVE as Outside Waratek scope instead
Finding Every Maven package this CVE affects (cc.tweaked:cc-tweaked-1.21-core, cc.tweaked:cc-tweaked-1.20.1-core, cc.tweaked:cc-tweaked-1.20.4-core, cc.tweaked:cc-tweaked-1.20.5-core, cc.tweaked:cc-tweaked-1.20.6-core, cc.tweaked:cc-tweaked-1.19.3-core, cc.tweaked:cc-tweaked-1.19.4-core, cc.tweaked:cc-tweaked-1.20-core) is on the excluded_maven_packages list in known-products.yaml, so it is not reviewed.

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
cc.tweaked:cc-tweaked-1.21-core 0 1.119.0 unbounded
cc.tweaked:cc-tweaked-1.20.1-core 0 1.119.0 unbounded
cc.tweaked:cc-tweaked-1.20.4-core 0 1.119.0 unbounded
cc.tweaked:cc-tweaked-1.20.5-core 0 1.119.0 unbounded
cc.tweaked:cc-tweaked-1.20.6-core 0 1.119.0 unbounded
cc.tweaked:cc-tweaked-1.19.3-core 0 1.119.0 unbounded
cc.tweaked:cc-tweaked-1.19.4-core 0 1.119.0 unbounded
cc.tweaked:cc-tweaked-1.20-core 0 1.119.0 unbounded

Products and versions

8 products, 8 version entries
SourceVendorProductSchemeAffected versions
osv cc.tweaked cc-tweaked-1.19.3-core generic ＜ 1.119.0
osv cc.tweaked cc-tweaked-1.19.4-core generic ＜ 1.119.0
osv cc.tweaked cc-tweaked-1.20-core generic ＜ 1.119.0
osv cc.tweaked cc-tweaked-1.20.1-core generic ＜ 1.119.0
osv cc.tweaked cc-tweaked-1.20.4-core generic ＜ 1.119.0
osv cc.tweaked cc-tweaked-1.20.5-core generic ＜ 1.119.0
osv cc.tweaked cc-tweaked-1.20.6-core generic ＜ 1.119.0
osv cc.tweaked cc-tweaked-1.21-core generic ＜ 1.119.0

References

URLTags
https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-5jh9-2h63-pw4q WEB
https://github.com/cc-tweaked/CC-Tweaked PACKAGE

Timeline
Published2026-07-21By the CVE Program.
NVD record modified2026-07-23NVD's own last-modified date for this record.