CVE-2026-57290

mediumpriority · track · 0EPSS 0.003 · 17 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.25% (17th) EPSS

CVSS 4.3 · medium

Is it mine?

18 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondaryexploitability 2.8 · impact 1.4

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · OSV

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-352USCWE-352US

affected products (18)

Products and version ranges known to be affected.

Red Hat OpenShift Developer Toolsall versionscert_bundDEcpe:/a:redhat:openshift:developer_tools
jenkins Jenkins≤ Active Directory Plugin <2.41.2cert_bundDE
jenkins Jenkins≤ Bitbucket Push and Pull Request Plugin <3.3.9cert_bundDE
jenkins Jenkins≤ Contrast Continuous Application Security Plugin <3.12cert_bundDE
jenkins Jenkins≤ EC2 Fleet Plugin <4.2.3.540.va_6eedb_7b_c112cert_bundDE
jenkins Jenkins≤ External Workspace Manager Plugin <1.4.0cert_bundDE
jenkins Jenkins≤ Git Parameter Plugin <462.463.v496a_59f698e5cert_bundDE
jenkins Jenkins≤ Git client Plugin <6.6.1cert_bundDE
jenkins Jenkins≤ GitHub Branch Source Plugin <1967.1970.vd86979736546cert_bundDE
jenkins Jenkins≤ Gitee Plugin <1292.v2559f2f3f2c0cert_bundDE
jenkins Jenkins≤ Job Configuration History Plugin <1367.vc8fa_b_15101dccert_bundDE
jenkins Jenkins≤ MCP Server Plugin <0.178.vffe5a_e770f3b_cert_bundDE
jenkins Jenkins≤ Pipeline: Groovy Plugin <4331.4333.v50a_b_076c5199cert_bundDE
jenkins Jenkins≤ Priority Sorter Plugin <936.937.v5581d0b_2ccb_a_cert_bundDE
jenkins Jenkins≤ Script Security Plugin <1402.1405.vc96e74964250cert_bundDE
Jenkins Project Jenkins Priority Sorter Plugin≤ 0 ≤936.v2c01c6b_84449enisa_euvdEU
jenkins priority sorter≤ 936.v2c01c6b_84449nvdUScpe:2.3:a:jenkins:priority_sorter:*:*:*:*:*:*:*:*
Maven org.jenkins-ci.plugins:PrioritySorter< 936.937.v5581d0bosvUSpkg:maven/org.jenkins-ci.plugins/PrioritySorter

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2074Jenkins Plugins: Mehrere SchwachstellenDeutsch2026-06-24csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen zu manipulieren oder offenzulegen.
GHSA-fq56-wvv2-p8jfJenkins Priority Sorter Plugin has a CSRF vulnerability2026-06-24ghsa · osvUS
Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration. This allows attackers to overwrite the global job priority configuration. Priority Sorter Plugin 936.937.v5581d0b_2ccb_a_ requires POST requests for the affected HTTP endpoint.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2026-06-24modified 2026-10-25

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan