CC: Tweaked EUVD-2026-67159

The critical non-default condition is that the Minecraft server host must be running in a dual-stack environment with RFC 8215 Local-Use NAT64 (prefix 64:ff9b:1::/48) active - this is an operator-configured network feature, not present in standard single-stack or typical home/shared-hosting deployments. Additionally, the attacker must have the ability to execute Lua code via a CC: Tweaked computer block, which requires in-game server access and physical or creative-mode access to a computer block (not restricted by default on most servers). The CC: Tweaked HTTP API must be enabled (it is on by default). Limiting factors are substantial: the RFC 8215 NAT64 deployment requirement is uncommon outside cloud-native or ISP-grade dual-stack infrastructure; players without computer block access cannot exploit this; and servers with strict permissions plugins or HTTP API disabled are fully protected without patching.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N, score 6.9) accurately reflects the attack profile: network-accessible, no privileges needed, but with AT:P (Attack Requirements Present) encoding the critical constraint that the server must be running a dual-stack RFC 8215 NAT64 configuration - a decidedly non-default and relatively uncommon deployment. The subsequent-system confidentiality impact is rated High (SC:H), consistent with the ability to reach cloud metadata services (e.g., 169.254.169.254 mapped as 64:ff9b:1::a9fe:a9fe) that can yield IAM credentials or internal API tokens. No EPSS data was provided in the source intelligence; without it, statistical exploitation probability cannot be quantified. The vulnerability is not in the CISA KEV catalog and no public exploit code has been identified, suggesting the risk is currently theoretical for most operators. The realistic threat is limited to the intersection of: Minecraft servers running CC: Tweaked, dual-stack infrastructure with RFC 8215 NAT64 enabled, and a threat actor already able to join the server and interact with computer blocks - a narrow but non-zero set. The missing EPSS score and absence of a minimum affected version from NVD introduce some uncertainty in prioritization.

A player on a dual-stack Minecraft server with RFC 8215 NAT64 active writes a short Lua script on an in-game CC: Tweaked computer calling http.request("http://[64:ff9b:1::a9fe:a9fe]/latest/meta-data/iam/security-credentials/"), targeting the cloud instance metadata service at 169.254.169.254 via its NAT64-mapped address. Because PrivatePattern.matches() does not recognize 64:ff9b:1::/48 as private, the request passes all SSRF filters and the server fetches the metadata response, returning IAM credential material to the player. No public proof-of-concept code for this specific variant has been identified at time of analysis.