CVE-2026-49820 getprobo CVE debrief

Who should care

Engineering and security teams using the Probo GRC platform should assess their exposure to this vulnerability and take immediate action to upgrade to probod v0.194.1 or later for self-hosted deployments. This is crucial because the vulnerability enables open-redirect phishing attacks, which can have significant operational impacts on the security posture of affected organizations. Verification of the fix is necessary to ensure the vulnerability is not

Why it matters

CVE-2026-49820 is an open-redirect vulnerability in Probo GRC platform that enables phishing attacks. Engineering and security teams using Probo should assess exposure and upgrade to probod v0.194.1 or later for self-hosted deployments. The vulnerability allows an attacker to craft a URL that appears to originate from a trusted Probo domain but redirects victims to an external domain.

• Open-redirect phishing attacks can be launched against users of the Probo GRC platform
• Self-hosted deployments require upgrade to probod v0.194.1 or later to fix the vulnerability
• Verification of the fix is necessary to ensure the vulnerability is not still exploitable

Technical summary

The `saferedirect` package in Probo validates redirect URLs used across authentication flows. Prior to version 0.19.3.1, the validator only inspected the second character of relative paths, allowing an attacker to craft a URL like `/../evil.com` that would pass validation. The fix normalizes relative paths with `path.Clean` before validation and rejects backslashes in the path. This change ensures that the intended same-origin restriction is enforced, preventing open-redirect phishing attacks. Self-hosted deployments should upgrade to probod v0.194.1 or later.

Defensive priority

Upgrade to probod v0.194.1 or later for self-hosted deployments. SaaS deployments on getprobo.com are patched.

Recommended defensive actions

• Upgrade to probod v0.194.1 or later for self-hosted deployments
• Verify the fix by testing the `saferedirect` package with different URL scenarios
• Monitor for suspicious activity on Probo deployments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the `saferedirect` package's incomplete validation of relative paths, which allows an attacker to bypass the intended same-origin restriction. The fix normalizes relative paths with `path.Clean` before validation and rejects backslashes in the path.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.