{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-105766 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-105766 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-105766 is a low-severity vulnerability in Chainguard Academy (edu), published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-105766 and fix it if it is affected.\n\nWhat it is: CVE-2026-105766 is a low-severity vulnerability in Chainguard Academy (edu), published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-105766 in the wild and no public exploit code.\n\nAffected product: Chainguard Academy (edu). No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-105766/ (Markdown: https://insights.sbomify.com/CVE-2026-105766/index.md)","id":"CVE-2026-105766","markdown":"https://insights.sbomify.com/CVE-2026-105766/index.md","name":"CVE-2026-105766","record":{"aliases":["GHSA-cfhv-267f-j755"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Chainguard Academy documentation","requires_auth":"none","summary":"An on-path attacker can downgrade HTTPS to HTTP for directory redirects, allowing them to read or modify documentation content served to non-HSTS clients.","user_interaction":"required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"chainguard","cpe":[],"cvss":{"score":2.3,"severity":"low","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-319","name":"Cleartext Transmission of Sensitive Information"}],"description":"Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentation content served to a victim via an HTTPS request for a slashless directory path, because TLS terminates at the load balancer in front of Nginx and the resulting 301 response redirects the client to a plaintext http:// URL. Browsers that ship the HSTS preload list are not affected, because the .dev top-level domain is preloaded; clients that do not enforce HSTS, such as command-line HTTP clients and scripts that follow redirects, are affected.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP","id":"CVE-2026-105766","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands","id":"CVE-2026-105767"},"packages":[],"prev":{"headline":"Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API","id":"CVE-2026-105765"},"products":["Chainguard Academy (edu)"],"published":"2026-10-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-06","vendors":["Chainguard"]},"summary":"An on-path attacker can downgrade HTTPS to HTTP for directory redirects, allowing them to read or modify documentation content served to non-HSTS clients.","url":"https://insights.sbomify.com/CVE-2026-105766/"}