# CVE-2026-64861: Probo GraphQL denial of service via alias flooding

Source: https://junglewise.ai/threats/cve-2026-64861-probo-is-a-self-hostable-governance-risk-and-compliance-grc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-64861 · Severity: medium · CVSS 4.3 · Published 2026-11-11

Probo is a governance, risk, and compliance platform used by engineering and security teams. An attacker can send a specially crafted GraphQL request with thousands of aliased queries to the unauthenticated endpoint, causing the server to consume excessive CPU and memory, degrading or disabling service for legitimate users. The issue affects all three GraphQL surfaces without authentication requirements.

Technologies: [Probo](https://junglewise.ai/threats/technologies/probo). Vendors: [Probo](https://junglewise.ai/threats/vendors/probo).

## Quick answers

**Is CVE-2026-64861 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64861 being exploited in the wild.

**How severe is CVE-2026-64861?** Medium severity, with a CVSS score of 4.3, published 11 November 2026.

**Which products and versions are affected?** Probo prior to 0.222.0.

**Is there a fix for CVE-2026-64861?** Yes: fixed in 0.222.0. Until then: Configure the GraphQL limits via environment variables (PROBOD_API_GRAPHQL_PARSER_TOKEN_LIMIT, PROBOD_API_GRAPHQL_COMPLEXITY_LIMIT) or Helm values (probo.graphql.*) to enforce stricter constraints on request parsing and field-selection complexity if upgrading is delayed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64861 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-64861?** Check whether you run Probo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.222.0

Configure the GraphQL limits via environment variables (PROBOD_API_GRAPHQL_PARSER_TOKEN_LIMIT, PROBOD_API_GRAPHQL_COMPLEXITY_LIMIT) or Helm values (probo.graphql.*) to enforce stricter constraints on request parsing and field-selection complexity if upgrading is delayed.

## Technical details

The vulnerability is an application-layer denial of service in the GraphQL endpoint caused by missing request validation. The gqlgen handler was configured with no limits on parser tokens, query depth, or complexity, allowing a single request with thousands of aliased resolver calls (e.g., repeated "viewer { id }" aliases) to be parsed, validated, executed, and marshalled in full. An unauthenticated attacker can send such requests to POST /api/connect/v1/graphql, /api/console/v1/graphql, or /api/trust/v1/graphql to drive excessive resource consumption. Version 0.222.0 patches this by adding configurable guards: a parser token limit (default 15000), a complexity limit (default 2000), an LRU query cache, and disabled suggestions.

## Affected products

- Probo Probo prior to 0.222.0

## Timeline

- 2026-11-11: disclosed
- 2026-06-30: patched

## References

- [https://github.com/getprobo/probo/commit/bf255b198cb6c9f44cd183c49743c9ffdaa44ce7](https://github.com/getprobo/probo/commit/bf255b198cb6c9f44cd183c49743c9ffdaa44ce7)
- [https://github.com/getprobo/probo/pull/1424](https://github.com/getprobo/probo/pull/1424)

## Related threats

- [Probo privilege escalation to OWNER via createUser](https://junglewise.ai/threats/cve-2026-76079-probo-is-a-self-hostable-governance-risk-and-compliance-grc)
- [Probo console cross-tenant insecure direct object reference in GraphQL](https://junglewise.ai/threats/cve-2026-63505-probo-is-a-self-hostable-governance-risk-and-compliance-grc)
- [Probo open redirect bypass via path normalization in saferedirect](https://junglewise.ai/threats/cve-2026-49820-probo-open-redirect-bypass-via-path-normalization-in-saferedirect)