Jenkins Priority Sorter Plugin has a CSRF vulnerability

MEDIUM 4.3CVE-2026-57290 · GHSA-fq56-wvv2-p8jf · Published 24/06/2026 · updated 25/10/2026

In short

CVE-2026-57290 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jenkins-ci.plugins:PrioritySorter, priority sorter (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.25%, higher than 16.9% of all vulnerabilities.
Fix: update to 936.937.v5581d0b or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:PrioritySorter Maven	`< 936.937.v5581d0b`	`936.937.v5581d0b`
priority sorter jenkins	`≤ 936.v2c01c6b_84449`	No fix yet

Description

Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration.

This allows attackers to overwrite the global job priority configuration.

Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ requires POST requests for the affected HTTP endpoint.

NVD description

A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.

References

nvd.nist.gov/vuln/detail/CVE-2026-57290 · ADVISORY
jenkinsci/priority-sorter-plugin commit 5581d0b · WEB
jenkinsci/priority-sorter-plugin · PACKAGE
jenkinsci/priority-sorter-plugin release 936.937.v5581d0b_2ccb_a_ · WEB
jenkins.io/security/advisory/2026-06-24 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free