---
id: "CVE-2026-64861"
page: "https://infrastack.ai/live/CVE-2026-64861"
kind: "vulnerability"
aliases: ["CVE-2026-64861"]
title: "Probo GRC platform: unlimited GraphQL aliases let one request degrade service"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["graphql", "other", "probo", "self-hosted"]
not_affected_if: ["managed-hosting", "version-0.222.0-or-later"]
published_at: "2026-11-11T19:17:43+00:00"
first_seen_at: "2026-11-11T19:28:47+00:00"
updated_at: "2026-11-11T19:30:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64861", "first_seen_at": "2026-11-11T19:28:47+00:00"}]
exploit_sources: []
---

# Probo GRC platform: unlimited GraphQL aliases let one request degrade service

Link for people: https://infrastack.ai/live/CVE-2026-64861 (this .md is for agents)

Probo, a self-hosted governance, risk and compliance platform, does not limit alias count, query depth or complexity on its GraphQL endpoint. A single crafted request with thousands of aliased calls can exhaust server resources and degrade the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Probo version and confirm whether it is below `0.222.0`
- Confirm whether the GraphQL endpoint is reachable from untrusted networks

## Fix

- Probo: upgrade to `0.222.0` or later

## Timeline

- 2026-11-11T19:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64861

## Documents

- [advisory] Vendor advisory: github.com https://github.com/getprobo/probo/security/advisories/GHSA-prh2-g8pv-m7p9
- [fix] Patch: github.com https://github.com/getprobo/probo/commit/bf255b198cb6c9f44cd183c49743c9ffdaa44ce7
- [fix] Release notes: github.com https://github.com/getprobo/probo/releases/tag/probod%2Fv0.222.0

## From the sources

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_