CVE-2026-57290
Jenkins Priority Sorter Plugin has a CSRF vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.
- Record
CVE-2026-57290- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2026-38771
A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.
- Record
EUVD-2026-38771- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fq56-wvv2-p8jf
Jenkins Priority Sorter Plugin has a CSRF vulnerability
Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration.
This allows attackers to overwrite the global job priority configuration.
Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ requires POST requests for the affected HTTP endpoint.
- Record
GHSA-fq56-wvv2-p8jf- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.
- Record
CVE-2026-57290- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-fq56-wvv2-p8jf
Jenkins Priority Sorter Plugin has a CSRF vulnerability
Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration.
This allows attackers to overwrite the global job priority configuration.
Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ requires POST requests for the affected HTTP endpoint.
- Record
GHSA-fq56-wvv2-p8jf- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:PrioritySorterMaven |
before 936.937.v5581d0b | 936.937.v5581d0b |
org.jenkins-ci.plugins:PrioritySorterMaven |
before 936.937.v5581d0b, plus listed versions 2.02.0-beta-12.0-beta-22.0-beta-32.1 Show 33 moreShow less2.112.122.22.32.42.52.62.72.82.93.03.0-beta-13.0-beta-23.13.23.33.43.4.13.5.03.5.13.6.04.0.04.0.14.1.05.0.05.1.05.2.05.3.0849.v459ea_77d16d4861.v1a_e68e5f9285863.v4a_b_974a_5d042905.v35c21f62f980936.v2c01c6b_84449 |
936.937.v5581d0b |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-57290 is a medium vulnerability (CVSS 4.3) in Jenkins Priority Sorter, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in org.jenkins-ci.plugins:PrioritySorter 936.937.v5581d0b.
References
jenkins.io/security/advisory/2026-06-24
nvd.nist.gov/vuln/detail/CVE-2026-57290
github.com/jenkinsci/priority-sorter-plugin/commit/5581d0b2ccbae6743dccabda90bc7b671dcaffd1