Chainguard Academy CVE-2026-105766

Exploitation requires three concrete conditions drawn from the description: (1) the attacker must hold an on-path/MITM network position between victim and server; (2) the victim must request a directory path WITHOUT a trailing slash over HTTPS, triggering the trailing-slash directory redirect that emits $scheme://...; and (3) the client must NOT enforce HSTS - command-line HTTP clients and scripts that follow redirects are affected, whereas HSTS-preload browsers are NOT, because the .dev TLD is on the preload list. The downgrade exists specifically because TLS terminates at the Cloud Run load balancer in front of Nginx, so $scheme evaluates to 'http'. These limiting factors (required MITM position, required non-HSTS client, required slashless path) sharply narrow realistic exploitation despite the network attack vector.

This is a genuinely low-priority issue, and the signals are largely consistent in saying so. The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N) yields a score of 2.3 (Low): although it is network-reachable and needs no privileges, it carries an Attack Requirement (AT:P, the attacker must already hold an on-path/MITM position) and passive user interaction (UI:P, the victim must follow the redirect), and the only impact is low integrity (VI:L) with no confidentiality or availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data - so exploitation status is 'no public exploit identified at time of analysis.' No signals conflict here: the low CVSS, absence of KEV/EPSS/POC, and the narrow preconditions all point the same direction. The one nuance worth stating explicitly is that the CWE-319 (cleartext transmission) risk is heavily mitigated for mainstream clients: the .dev TLD is on the HSTS preload list, so modern browsers never honor the http:// downgrade; only non-HSTS-enforcing clients (curl, wget, scripts following redirects) are exposed, and only when an attacker is already on-path. This is a defense-in-depth hardening fix for a single documentation website, not an urgent patch.

An attacker positioned on the network path (e.g. shared Wi-Fi, a compromised router, or an upstream hop) between a victim and Chainguard Academy waits for a request to a slashless directory path over HTTPS. Because TLS terminates at the Cloud Run load balancer, Nginx sees $scheme as 'http' and returns a 301 redirecting the client to a plaintext http:// URL; a non-HSTS client such as curl or a scripting tool follows it in cleartext, letting the attacker read or tamper with the documentation content returned. No public exploit code is referenced, and HSTS-preload browsers are immune.