CVE-2026-64861

CVSS 4.3 (medium) · published 2026-11-11

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0.

Weakness: CWE-770

Source: NVD CVE-2026-64861

References

• https://github.com/getprobo/probo/commit/bf255b198cb6c9f44cd183c49743c9ffdaa44ce7
• https://github.com/getprobo/probo/pull/1424
• https://github.com/getprobo/probo/releases/tag/probod%2Fv0.222.0
• https://github.com/getprobo/probo/security/advisories/GHSA-prh2-g8pv-m7p9

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.