# CVE-2026-57290: Jenkins Priority Sorter Plugin CSRF in global job priority configuration

Source: https://junglewise.ai/threats/cve-2026-57290-jenkins-priority-sorter-plugin-csrf-in-global-job-priority  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-57290 · Severity: medium · CVSS 4.3 · Published 2026-06-24

The Jenkins Priority Sorter Plugin, which allows administrators to manage the execution order of build jobs, contains a security flaw. An attacker could trick a logged-in administrator into clicking a malicious link, which would then automatically change the global job priority settings. This could disrupt normal operations by causing critical tasks to be delayed or less important tasks to take precedence.

Vendors: [Jenkins Project](https://junglewise.ai/threats/vendors/jenkins-project), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-57290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57290 being exploited in the wild.

**How severe is CVE-2026-57290?** Medium severity, with a CVSS score of 4.3, published 24 June 2026.

**Which products and versions are affected?** Jenkins Project Priority Sorter Plugin 936.v2c01c6b_84449 and earlier; org.jenkins-ci.plugins:PrioritySorter (Maven) < 936.937.v5581d0b, ECOSYSTEM:introduced=0,fixed=936.937.v5581d0b.

**Is there a fix for CVE-2026-57290?** Yes. org.jenkins-ci.plugins:PrioritySorter (Maven): upgrade to 936.937.v5581d0b or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57290 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57290?** Check whether you run Jenkins Project Priority Sorter Plugin or org.jenkins-ci.plugins:PrioritySorter (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jenkins-ci.plugins:PrioritySorter (Maven): upgrade to 936.937.v5581d0b or later

  ```sh
  # set org.jenkins-ci.plugins:PrioritySorter to 936.937.v5581d0b in your pom.xml or build.gradle
  ```


## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Jenkins Priority Sorter Plugin through version 936.v2c01c6b_84449. The vulnerability is located in the HTTP endpoint responsible for saving global job priority configurations, which fails to implement proper crumb/token validation. An unauthenticated remote attacker can exploit this by inducing a Jenkins administrator to visit a specially crafted webpage. Successful exploitation allows the attacker to overwrite global plugin settings, potentially impacting the scheduling and execution order of all jobs on the Jenkins controller. As of the advisory date, a fix has not been specified in the provided text, though users are generally advised to update to the latest version.

## Affected products

- Jenkins Project Priority Sorter Plugin 936.v2c01c6b_84449 and earlier

## Identifiers

- CVE-2026-57290
- GHSA-fq56-wvv2-p8jf

## Timeline

- 2026-06-24: disclosed
- 2026-06-24: advisory

## References

- [https://www.jenkins.io/security/advisory/2026-06-24/](https://www.jenkins.io/security/advisory/2026-06-24/)