CVE-2026-57290: Jenkins Priority Sorter Plugin CSRF Vulnerability – Patch & Detection Guide

Technical summary

CVE-2026-57290 is a CSRF vulnerability (CWE-352) affecting Jenkins Priority Sorter Plugin up to and including version 936.v2c01c6b_84449. The vulnerability stems from insufficient cross-site request forgery protections on endpoints that modify global job priority configuration. An unauthenticated attacker can craft a request that, when executed in the browser context of an authenticated Jenkins administrator, alters priority settings without explicit consent or validation of origin. The CVSS 3.1 score of 4.3 reflects a network-based attack requiring user interaction, causing integrity impact but no confidentiality or availability compromise.

Business impact

If exploited, this vulnerability could allow adversaries to manipulate job scheduling priorities across a Jenkins instance, potentially causing operational disruption by starving legitimate jobs of resources or elevating the priority of malicious jobs. For organizations relying on Jenkins for CI/CD pipelines, this could affect deployment schedules, testing throughput, and overall pipeline reliability. While the technical impact is bounded to configuration changes, the operational consequences depend on how job priorities affect your business processes.

Affected systems

Jenkins Priority Sorter Plugin versions 936.v2c01c6b_84449 and earlier are affected. The vulnerability requires the plugin to be installed and at least one administrator to visit a malicious link while logged into Jenkins. Organizations running newer versions of the plugin (if available) are not vulnerable. The impact is limited to Jenkins instances where the plugin is deployed and active.

Exploitability

Exploitation requires social engineering; an attacker must trick a Jenkins administrator into visiting a malicious webpage or clicking a crafted link while logged into Jenkins. There is no unauthenticated remote code execution or automatic exploitation vector. The barrier to entry is moderate—an attacker needs knowledge of Jenkins, understanding of the plugin's configuration endpoints, and a way to deliver the malicious request to an admin. This is not actively exploited in the wild according to current KEV data.

Remediation

Update the Jenkins Priority Sorter Plugin to a version newer than 936.v2c01c6b_84449. Check the official Jenkins plugin repository or vendor advisory for the specific patched version. As an interim control, restrict plugin configuration access to a small set of trusted administrators and educate staff on phishing and social engineering risks. Consider network-based controls such as Content Security Policy headers to mitigate CSRF attacks more broadly.

Patch guidance

Verify the latest available version of the Jenkins Priority Sorter Plugin in the official Jenkins update center. Update through the Jenkins plugin management interface, or download and install the patched version manually from the Jenkins project repository. Test in a non-production environment first to ensure compatibility with your Jenkins version and other plugins. After patching, verify that job priority settings have not been altered unexpectedly.

Detection guidance

Monitor Jenkins logs for unexpected changes to Priority Sorter Plugin configuration, particularly modifications made by or attributed to administrative users during off-hours or from unusual sources. Look for HTTP requests to the plugin's configuration endpoints (typically under /manage or similar paths) that originate from referrers outside your Jenkins domain. Web application firewalls or reverse proxies can detect malformed CSRF tokens or missing origin headers on sensitive endpoints. Audit Jenkins administrator login sessions for anomalous activity around the time of potential configuration changes.

Why prioritize this

While the CVSS score is moderate (4.3), this vulnerability warrants prompt remediation because it affects a core CI/CD component and requires only social engineering to exploit. A compromised job priority configuration can cascade into supply chain risks if malicious jobs are elevated or legitimate builds are delayed. Organizations running Jenkins at scale should treat plugin updates seriously, as the attack surface is real even if the current exploitation risk is low.

Risk score, explained

The CVSS 3.1 base score of 4.3 (MEDIUM) reflects: a network-based attack vector (AV:N) with low complexity (AC:L) requiring no special privileges (PR:N) but requiring user interaction (UI:R). The impact scope is unchanged (S:U), with integrity impact (I:L) from configuration modification but no confidentiality or availability impact (C:N/A:N). The score appropriately represents a bounded, user-interaction-dependent threat that affects configuration integrity rather than data theft or system availability.

Frequently asked questions