Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP
Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentation content served to a victim via an HTTPS request for a slashless directory path, because TLS terminates at the load balancer in front of Nginx and the resulting 301 response redirects the client to a plaintext http:// URL. Browsers that ship the HSTS preload list are not affected, because the .dev top-level domain is preloaded; clients that do not enforce HSTS, such as command-line HTTP clients and scripts that follow redirects, are affected.
CVE-2026-105766
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-105766
Chainguard Academy (edu)
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/chainguard-dev/edu",
"vendor": "Chainguard",
"modules": [
"Nginx trailing-slash directory redirect"
],
"product": "Chainguard Academy (edu)",
"versions": [
{
"status": "affected",
"version": "0b75ff98057f69b044a3e7194e428066ac5ad0d4",
"lessThan": "93dc0e50739c225f5aee2e803800a47fc0feb906",
"versionType": "git"
}
],
"programFiles": [
"nginx.conf"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-105766
Source reference:
/cveMetadata/cveId
Publisher severity
low
Source reference: /containers/cna/metrics
- Event
- #9289 · Revision 1
- Added to Heist Feed
- Publisher date