Read the docs
TI-2026-68376 Aliases CVE-2026-105766GHSA-cfhv-267f-j755

Chainguard Academy Nginx redirect downgrades HTTPS to HTTP

Priority LOW 11CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 is affected. The directory redirect in the Nginx configuration file uses the backend-facing scheme variable. After TLS ends at the load balancer, the redirect sends clients to a plaintext HTTP URL (CWE-319). An on-path network attacker can read or modify documentation served to a victim who requests a slashless directory path over HTTPS, if the client does not enforce HSTS.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentation content served to a victim via an HTTPS request for a slashless directory path, because TLS terminates at the load balancer in front of Nginx and the resulting 301 response redirects the client to a plaintext http:// URL. Browsers that ship the HSTS preload list are not affected, because the .dev top-level domain is preloaded; clients that do not enforce HSTS, such as command-line HTTP clients and scripts that follow redirects, are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00106 1st percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

Chainguard Academy (edu) is fixed in commit 93dc0e50739c225f5aee2e803800a47fc0feb906.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105766
  2. 2026-10-06 Alias added: GHSA-cfhv-267f-j755
  3. 2026-10-06 CISA SSVC decision points changed

References

Patch 2

  • TI-2024-23955 apko Exposure of HTTP basic auth credentials in log output CVSS 3.1HIGH 7.5
  • TI-2026-22680 kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory CVSS 3.1HIGH 8.2
  • TI-2026-83911 kaniko sends Azure access tokens to lookalike ACR registry hosts CVSS 3.1CRITICAL 9.3
  • TI-2026-30854 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root CVSS 3.1HIGH 7.5
  • TI-2026-20302 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams CVSS 3.1HIGH 7.5
  • TI-2026-20284 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences