Probo: Denial of service via GraphQL alias flooding
Summary
Probo, a self-hostable GRC platform, does not limit alias count, query depth or query complexity on its GraphQL endpoint. An authenticated user can send one request with thousands of aliased resolver calls, which drives up server CPU and memory use and can degrade or interrupt the service. Confidentiality and integrity are not affected according to the CVSS vector.
Affected
- Probo versions before 0.222.0
Fixed in
- Upgrade to Probo 0.222.0 or later (vendor fix in release probod/v0.222.0; newer releases also contain later fixes)
Workaround
- Unknown. No vendor-documented workaround for unpatched instances was found.
- Until patched, restrict access to the GraphQL endpoint (for example via VPN or reverse proxy) and apply rate limits at the proxy.
Exploitation
- No public proof of concept found.
- No evidence of exploitation in the wild found; not listed in CISA KEV (not independently verified).
- The original reporter's impact figures are self-reported and unverified.
Our recommendation
- Upgrade all Probo instances to 0.222.0 or, preferably, the newest release.
- Check whether the GraphQL endpoint is internet-facing and limit access where possible.
- Monitor availability and resource usage of the Probo service.
- Review user accounts, since the attack requires a valid account (PR:L).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-64861 www.cve.org
- GitHub Security Advisory GHSA-prh2-g8pv-m7p9 github.com
- Probo release v0.222.0 github.com
- Fix commit bf255b1 github.com
- Fix pull request #1424 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:15.
Original description (NVD)
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.