A configuration mistake in Chainguard Academy’s Nginx service caused the backend-facing $scheme variable to be used when constructing a trailing‑slash redirect. Because TLS terminates at a front‑end load balancer, the resulting 301 redirect pointed clients from https to an http URL. An on‑path attacker can thus intercept, read, or modify documentation that a victim receives over what they believe is an encrypted channel.

The vulnerability affected the Chainguard Academy (edu) deployment at edu.chainguard.dev, specifically the Nginx configuration present before the commit that hardcoded the https scheme. The fix was applied in commit 93dc0e50739c225f5aee2e803800a47fc0feb906 and is currently in production.

The CVSS score of 2.3 indicates low severity, with no EPSS data available and no listing in the CISA KEV catalog. Exploitation requires an attacker that can position themselves on the same network path as the load balancer to trigger the downgrade. Clients that do not enforce HSTS or that automatically follow redirects, such as command‑line tools and scripts, are vulnerable, while browsers that use the .dev HSTS preload list are protected.