CC‑Tweaked’s HTTP API blocks private network addresses to prevent SSRF. Prior to version 1.119.0, the filter was inadvertently bypassed on IPv6‑capable servers that use NAT64. An attacker who can run Lua code can target any internal IPv4 service by forming a NAT64 URL, for example http://[64:ff9b::<ipv4-as-hex>]/, tricking the API into routing the request to the private host. This bypass allows the attacker to read or manipulate internal services, effectively achieving a Server‑Side Request Forgery. The vulnerability is CVE-2026-47695, a classic SSRF flaw (CWE-918).

Affected deployments are those running CC‑Tweaked earlier than version 1.119.0 on cloud or private networks that support IPv6 routing and NAT64 (common on AWS, GCP, and other cloud services with IPv6‑only subnets). The trick exploits the mod’s public HTTP API (http.request, http.websocket). The issue is resolved in 1.119.0, where the NAT64 bypass is eliminated.

The CVSS score of 7.1 indicates high risk, while an EPSS score of less than 1 % suggests a low likelihood of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires code execution on the server, typically by running Lua in the game environment. Once inside, an attacker can redirect script requests to any IPv4 address, effectively bypassing the intended SSRF protection. The likely vector is local to the Minecraft server, but internal network reach can be achieved via staging of NAT64 addresses.