CVE-2026-55758 CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection
An attacker with Lua execution rights can bypass SSRF protections to access internal network resources via NAT64 prefixes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55758?
CVE-2026-55758 is a medium-severity server-side request forgery vulnerability in CC-Tweaked, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the RFC 8215 64:ff9b:1::/48 local-use prefix. On a dual-stack server using RFC 8215 NAT64, an unauthenticated user who can execute Lua code can use http.request or http.websocket with an address under 64:ff9b:1::/48 to reach loopback, RFC 1918, cloud metadata, or internal API endpoints because PrivatePattern.matches() does not classify the mapped IPv6 address as private. This issue is fixed in version 1.120.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-55758?
How do I fix CVE-2026-55758?
No fix has been published for CVE-2026-55758 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-55758 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55758 exists.
Sources
Also known as GHSA-2rrx-mch2-76cp.