Detections
Analytics

SCA: security update for go.probo.inc/probo (GHSA-x7qq-m748-8p2c)

medium Tenable Cloud Security Plugin ID 444179

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and
 security teams. Probo's `saferedirect` package validates redirect URLs used across authentication flows
 (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). Prior to version 0.19.3.1,
 the validator only inspected the second character of relative paths, so a URL like `/../\evil.com` passed
 validation because the second character is `.`. Go's `http.Redirect` normalizes this path to `/\evil.com`
 before setting the `Location` header. Browsers can interpret the backslash as a host separator and
 redirect the user to an external domain (`https://evil.com`), bypassing the intended same-origin
 restriction. This enables open-redirect phishing: an attacker can craft a `continue` parameter (or embed a
 malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but
 redirects victims elsewhere. This is fixed in `go.probo.inc/probo` 0.193.1 by normalizing relative paths
 with `path.Clean` before validation, rejecting backslashes (including percent-encoded `%5c`) anywhere in
 the path, and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted
 deployments should upgrade to probod v0.194.1 or later. SaaS deployments on getprobo.com are patched. No
 practical workaround is available for self-hosted installations. (CVE-2026-49820)

Solution

Update the go.probo.inc/probo library and its related packages to version 0.204.0 or later.

See Also

https://github.com/advisories/GHSA-x7qq-m748-8p2c

Plugin Details

Severity: Medium

ID: 444179

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 6/30/2026

Updated: 8/14/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-49820

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/30/2026

Vulnerability Publication Date: 6/30/2026

Reference Information

CVE: CVE-2026-49820

cwe: CWE-601