Jenkins Priority Sorter Plugin has a CSRF vulnerability

MEDIO 4.3CVE-2026-57290 · GHSA-fq56-wvv2-p8jf · Published 24/06/2026 · updated 25/10/2026

In breve

CVE-2026-57290 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda org.jenkins-ci.plugins:PrioritySorter, priority sorter (jenkins).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.25%, superiore al 16.9% delle vulnerabilità.
Correzione: aggiornare a 936.937.v5581d0b o successiva.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:PrioritySorter Maven	`< 936.937.v5581d0b`	`936.937.v5581d0b`
priority sorter jenkins	`≤ 936.v2c01c6b_84449`	No fix yet

Description

Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration.

This allows attackers to overwrite the global job priority configuration.

Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ requires POST requests for the affected HTTP endpoint.

NVD description

A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.

References

nvd.nist.gov/vuln/detail/CVE-2026-57290 · ADVISORY
jenkinsci/priority-sorter-plugin commit 5581d0b · WEB
jenkinsci/priority-sorter-plugin · PACKAGE
jenkinsci/priority-sorter-plugin release 936.937.v5581d0b_2ccb_a_ · WEB
jenkins.io/security/advisory/2026-06-24 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:PrioritySorter

Maven

< 936.937.v5581d0b

936.937.v5581d0b

priority sorter

jenkins

≤ 936.v2c01c6b_84449

No fix yet

Description

Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration.

This allows attackers to overwrite the global job priority configuration.

Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ requires POST requests for the affected HTTP endpoint.

NVD description

A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.