---
id: CVE-2026-57290
aliases:
  - GHSA-fq56-wvv2-p8jf
title: Jenkins Priority Sorter Plugin has a CSRF vulnerability
summary: Jenkins Priority Sorter Plugin has a CSRF vulnerability
severity: medium
cvss: 4.3
cwe:
  - CWE-352
vendor: jenkins-ci
product: 'org.jenkins-ci.plugins:PrioritySorter'
ecosystem: maven
affected:
  - 'org.jenkins-ci.plugins:PrioritySorter < 936.937.v5581d0b'
patched:
  - 'org.jenkins-ci.plugins:PrioritySorter 936.937.v5581d0b'
published: '2026-06-24'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T19:07:40Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-fq56-wvv2-p8jf'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57290'
  - url: 'https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3769'
  - url: >-
      https://github.com/jenkinsci/priority-sorter-plugin/commit/5581d0b2ccbae6743dccabda90bc7b671dcaffd1
  - url: >-
      https://github.com/jenkinsci/priority-sorter-plugin/releases/tag/936.937.v5581d0b_2ccb_a_
  - url: 'https://github.com/advisories/GHSA-fq56-wvv2-p8jf'
tags:
  - ghsa
  - maven
epss: 0.00254
epssPercentile: 0.15085
ingestedAt: '2026-09-25T19:15:38.959Z'
---

## Overview

Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration.

This allows attackers to overwrite the global job priority configuration.

Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ requires POST requests for the affected HTTP endpoint.

## Affected packages

- `org.jenkins-ci.plugins:PrioritySorter < 936.937.v5581d0b`

## Remediation

Upgrade to a patched release:

- `org.jenkins-ci.plugins:PrioritySorter 936.937.v5581d0b`