CVE-2026-105766 Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP
An on-path attacker can downgrade HTTPS to HTTP for directory redirects, allowing them to read or modify documentation content served to non-HSTS clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-105766?
CVE-2026-105766 is a low-severity vulnerability in Chainguard Academy (edu), published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentation content served to a victim via an HTTPS request for a slashless directory path, because TLS terminates at the load balancer in front of Nginx and the resulting 301 response redirects the client to a plaintext http:// URL. Browsers that ship the HSTS preload list are not affected, because the .dev top-level domain is preloaded; clients that do not enforce HSTS, such as command-line HTTP clients and scripts that follow redirects, are affected.
Weakness: CWE-319
Which versions are affected by CVE-2026-105766?
How do I fix CVE-2026-105766?
No fix has been published for CVE-2026-105766 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-105766 being exploited?
There is no known exploitation of CVE-2026-105766 in the wild and no public exploit code.
Sources
Also known as GHSA-cfhv-267f-j755.