Popular programmable computers and turtles mod contains an SSRF flaw that lets players query metadata endpoints on AWS, Azure, GCP and others. Server owners on cloud hosting should update or reconfigure immediately.
If you host a Minecraft server on AWS, Azure, Google Cloud or similar and run CC: Tweaked, stop what you are doing and check your setup. A long-standing SSRF vulnerability lets players use in-game computers to query cloud metadata services that were never properly blocked in default configurations.
The impact is straightforward and ugly. Attackers can pull IAM role credentials, boot-time user data that often contains secrets, and other information that lets them pivot from your Minecraft server into the broader cloud account. This is not theoretical for anyone running public or semi-public servers on cloud infrastructure.
Who is actually exposed
- Running CC: Tweaked with the HTTP API enabled
- Using a cloud provider that exposes unauthenticated metadata endpoints (AWS, Azure, GCP, DigitalOcean, Oracle, Alibaba and others)
- Not running a strict whitelist-only HTTP config or the latest patched release
The project maintainers released updates for all supported Minecraft versions. For 1.20.1 and 1.19.4 you want CC: Tweaked 1.106.0 or later. Older supported branches got 1.101.3. If you cannot update the mod, the recommendation is to disable the HTTP API entirely or add the metadata endpoints to the blocked domains list.
Testing it yourself is simple. Place a computer, run a short Lua snippet that tries to reach the common metadata IPs, and see if it succeeds. If it does, you are vulnerable. The GitHub post walks through exact steps and the corrected blocked_domains config.
Many popular cloud providers offer a metadata services API endpoint, which can be queried by a host machine. These metadata APIs are not blocked by CC: Tweaked’s default configuration.
This one is on server operators. Mojang has no role here. The mod team responded responsibly once the issue was reported in 2023 but the reality is that many servers never updated the config or the mod. If your hosting provider gives you a public IP and you run this mod, verify your status today.
News
Forum