CVE-2026-105766: CWE-319 Cleartext Transmission of Sensitive Information in Chainguard Chainguard Academy (edu)

The vulnerability in Chainguard Academy (edu) stems from the backend use of the $scheme variable in nginx.conf's trailing-slash directory redirect configuration. When a client requests a directory path without a trailing slash over HTTPS, the server responds with a 301 redirect to the same path but with a trailing slash. However, because TLS terminates at the load balancer, the redirect Location header uses the $scheme variable, which results in an HTTP URL instead of HTTPS. This downgrade to plaintext HTTP allows an on-path network attacker to read or modify the redirected content. Clients enforcing HSTS for the .dev top-level domain are protected, but clients that do not enforce HSTS, including some command-line tools and scripts, remain vulnerable.

An on-path attacker can intercept and modify documentation content served to clients following the redirect from HTTPS to HTTP. This could lead to exposure or tampering of sensitive information during the redirect process. The impact is limited by the fact that browsers with HSTS preload support for the .dev domain will not follow the insecure redirect, reducing the attack surface. However, non-browser clients without HSTS enforcement are susceptible to this downgrade attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, clients should ensure they enforce HSTS policies or avoid following redirects from HTTPS to HTTP. Vendors should update the nginx configuration to avoid using the $scheme variable in redirects when TLS terminates at a load balancer, ensuring redirects preserve HTTPS URLs.