MEDIUM 4.3 Maven
Jenkins Priority Sorter Plugin has a CSRF vulnerability
GHSA-fq56-wvv2-p8jf · CVE-2026-57290
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration.
This allows attackers to overwrite the global job priority configuration.
Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ requires POST requests for the affected HTTP endpoint.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-57290
- WEB https://github.com/jenkinsci/priority-sorter-plugin/commit/5581d0b2ccbae6743dccabda90bc7b671dcaffd1
- PACKAGE https://github.com/jenkinsci/priority-sorter-plugin
- WEB https://github.com/jenkinsci/priority-sorter-plugin/releases/tag/936.937.v5581d0b_2ccb_a_
- WEB https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3769
Ready to move
Start Securing
Free, no credit card | First findings in minutes