CVE-2026-105766

Name of the Vulnerable Software and Affected Versions Chainguard Academy (edu) versions from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 through commit 93dc0e50739c225f5aee2e803800a47fc0feb906

Description An issue exists in the nginx.conf file where the use of the backend-facing $scheme variable in the trailing-slash directory redirect allows an on-path network attacker to read or modify documentation content. This occurs when a victim makes an HTTPS request for a slashless directory path; since TLS terminates at the load balancer in front of Nginx, the resulting 301 response redirects the client to a plaintext http:// URL. This affects clients that do not enforce HSTS (HTTP Strict Transport Security), such as scripts that follow redirects and command-line HTTP clients. Browsers with a preloaded HSTS list are not affected due to the .dev top-level domain being preloaded.

Recommendations Update Chainguard Academy (edu) to commit 93dc0e50739c225f5aee2e803800a47fc0feb906.