{"id":"CVE-2026-105766","summary":"Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP","details":"Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentation content served to a victim via an HTTPS request for a slashless directory path, because TLS terminates at the load balancer in front of Nginx and the resulting 301 response redirects the client to a plaintext http:// URL. Browsers that ship the HSTS preload list are not affected, because the .dev top-level domain is preloaded; clients that do not enforce HSTS, such as command-line HTTP clients and scripts that follow redirects, are affected.","modified":"2026-10-08T02:50:31.419222248Z","published":"2026-10-05T19:45:50.015Z","database_specific":{"cwe_ids":["CWE-319"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105766.json","cna_assigner":"chainguard"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105766.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105766"},{"type":"FIX","url":"https://github.com/chainguard-dev/edu/commit/93dc0e50739c225f5aee2e803800a47fc0feb906"},{"type":"FIX","url":"https://github.com/chainguard-dev/edu/pull/3989"},{"type":"PACKAGE","url":"https://github.com/chainguard-dev/edu"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/chainguard-dev/edu","events":[{"introduced":"0b75ff98057f69b044a3e7194e428066ac5ad0d4"},{"fixed":"93dc0e50739c225f5aee2e803800a47fc0feb906"}],"database_specific":{"source":"REFERENCES"}}],"versions":["ai-docs-20260430-121310","ai-docs-20260429-150259","ai-docs-20260429-134421","ai-docs-20260429-133408","ai-docs-20260428-132624","ai-docs-20260428-120411","ai-docs-20260427-135041","ai-docs-20260427-125209","ai-docs-20260427-122413","ai-docs-20260426-030135","ai-docs-20260426-021819","ai-docs-20260424-122346","ai-docs-20260423-185744","ai-docs-20260423-182027","ai-docs-bundle","ai-docs-latest","ai-docs"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105766.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}