{"id":"CVE-2026-64861","kind":"vulnerability","aliases":["CVE-2026-64861"],"related":[],"title":"Probo GRC platform: unlimited GraphQL aliases let one request degrade service","description":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0.","summary":"Probo, a self-hosted governance, risk and compliance platform, does not limit alias count, query depth or complexity on its GraphQL endpoint. A single crafted request with thousands of aliased calls can exhaust server resources and degrade the service.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graphql","other","probo","self-hosted"],"not_affected_if":["managed-hosting","version-0.222.0-or-later"],"how_to_check":"- Check the installed Probo version and confirm whether it is below `0.222.0`\n- Confirm whether the GraphQL endpoint is reachable from untrusted networks","fix":"- Probo: upgrade to `0.222.0` or later","status":"open","published_at":"2026-11-11T19:17:43+00:00","first_seen_at":"2026-11-11T19:28:47+00:00","triaged_at":"2026-11-11T19:30:38+00:00","updated_at":"2026-11-11T19:30:38+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T19:30:38Z","model":"claude-haiku-5-5","output":{"fix":"- Probo: upgrade to `0.222.0` or later","reach":"network","title":"Probo GRC platform: unlimited GraphQL aliases let one request degrade service","impact":"low","summary":"Probo, a self-hosted governance, risk and compliance platform, does not limit alias count, query depth or complexity on its GraphQL endpoint. A single crafted request with thousands of aliased calls can exhaust server resources and degrade the service.","audience":"businesses","category":"other","nicknames":[],"who_cares":["probo","self-hosted","graphql"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Service degradation from resource exhaustion on the server","analyst_note":"","how_to_check":"- Check the installed Probo version and confirm whether it is below `0.222.0`\n- Confirm whether the GraphQL endpoint is reachable from untrusted networks","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.222.0-or-later","managed-hosting"],"who_is_affected":"Teams that self-host Probo and expose its GraphQL endpoint to users or networks outside their control are exposed. Instances on a patched version or reachable only from trusted internal networks carry less risk. The sources do not say whether the flaw needs an account.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.00071,"input_tokens":4636,"output_tokens":492,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-64861':14A,17A '0.222.0':85C,131C 'alia':37B,94C 'alias':6A,54B,111C 'attack':102C 'built':76C 'call':55B,113C 'caus':114C 'complex':42B,100C 'complianc':32B,73C 'consumpt':120C 'contain':108C 'count':38B,95C 'craft':49B 'cve':12A,15A 'degrad':10A,61B,123C 'depth':40B,97C 'endpoint':46B,88C 'enforc':91C 'engin':78C 'excess':115C 'exhaust':57B 'govern':29B,70C 'graphql':5A,18B,45B,87C 'grc':2A,74C 'host':23B,28B 'hostabl':69C 'issu':125C 'let':7A 'limit':36B 'one':8A 'patch':128C 'platform':3A,33B,75C 'prior':82C 'probo':1A,20B,24B,64C 'queri':39B,96C,99C 'request':9A,50B,107C 'resolv':112C 'resourc':59B,119C 'restrict':92C 'risk':30B,71C 'secur':80C 'self':22B,27B,68C 'self-host':21B,26B,67C 'send':104C 'server':58B,117C 'server-sid':116C 'servic':11A,63B,122C 'side':118C 'singl':48B,106C 'team':81C 'thousand':52B,109C 'unlimit':4A 'version':84C,130C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Probo and expose its GraphQL endpoint to users or networks outside their control are exposed. Instances on a patched version or reachable only from trusted internal networks carry less risk. The sources do not say whether the flaw needs an account.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["graphql","medium","other","probo","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-64861':14A,17A 'alias':6A 'cve':12A,15A 'degrad':10A 'graphql':5A 'grc':2A 'let':7A 'one':8A 'platform':3A 'probo':1A 'request':9A 'servic':11A 'unlimit':4A","search_b":"'alia':37B 'alias':54B 'call':55B 'complex':42B 'complianc':32B 'count':38B 'craft':49B 'degrad':61B 'depth':40B 'endpoint':46B 'exhaust':57B 'govern':29B 'graphql':18B,45B 'host':23B,28B 'limit':36B 'platform':33B 'probo':20B,24B 'queri':39B 'request':50B 'resourc':59B 'risk':30B 'self':22B,27B 'self-host':21B,26B 'server':58B 'servic':63B 'singl':48B 'thousand':52B","search_c":"'0.222.0':85C,131C 'alia':94C 'alias':111C 'attack':102C 'built':76C 'call':113C 'caus':114C 'complex':100C 'complianc':73C 'consumpt':120C 'contain':108C 'count':95C 'degrad':123C 'depth':97C 'endpoint':88C 'enforc':91C 'engin':78C 'excess':115C 'govern':70C 'graphql':87C 'grc':74C 'hostabl':69C 'issu':125C 'patch':128C 'platform':75C 'prior':82C 'probo':64C 'queri':96C,99C 'request':107C 'resolv':112C 'resourc':119C 'restrict':92C 'risk':71C 'secur':80C 'self':68C 'self-host':67C 'send':104C 'server':117C 'server-sid':116C 'servic':122C 'side':118C 'singl':106C 'team':81C 'thousand':109C 'version':84C,130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T10:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64861","severity":null,"published_at":"2026-11-11T19:17:43+00:00","modified_at":"2026-11-11T19:17:43+00:00","first_seen_at":"2026-11-11T19:28:47+00:00","fetched_at":"2026-11-11T19:28:47+00:00","note":null}],"documents":[{"id":128141,"url":"https://github.com/getprobo/probo/commit/bf255b198cb6c9f44cd183c49743c9ffdaa44ce7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128142,"url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.222.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":128143,"url":"https://github.com/getprobo/probo/security/advisories/GHSA-prh2-g8pv-m7p9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T10:18:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}