EUVD-2026-38771
GHSA-fq56-wvv2-p8jf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered CSRF needs no attacker credentials but mandates victim browser interaction; impact is integrity-only, limited to job priority configuration with no scope change.
Primary rating from Vendor (jenkins).
CVSS VectorVendor: jenkins
Lifecycle Timeline
2DescriptionCVE.org
A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to overwrite the global job priority configuration.
AnalysisAI
Cross-site request forgery in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier enables a network-based attacker to overwrite global job priority configuration by luring an authenticated Jenkins user into triggering a forged HTTP request. Exploitation requires mandatory victim interaction and produces only limited integrity impact - no confidentiality or availability loss. No public exploit code exists, EPSS sits at the 1st percentile, and CISA SSVC records exploitation status as none, making this a low operational priority for most organizations.
Technical ContextAI
Jenkins Priority Sorter Plugin extends the Jenkins CI/CD automation server to manage relative execution priorities among jobs queued in the build scheduler. CWE-352 (Cross-Site Request Forgery) identifies the root cause: the plugin endpoint responsible for persisting global priority configuration fails to validate a CSRF token, allowing a forged state-changing POST to be submitted under an authenticated user's active session. CSRF attacks exploit the browser's automatic inclusion of session cookies - since Jenkins trusts the browser, a request originating from a third-party malicious page is indistinguishable from a legitimate one if no nonce or origin check is enforced. CPE cpe:2.3:a:jenkins_project:jenkins_priority_sorter_plugin:*:*:*:*:*:*:*:* confirms all versions up to and including 936.v2c01c6b_84449 lack this control.
RemediationAI
Upgrade Jenkins Priority Sorter Plugin to the version released after 936.v2c01c6b_84449 as specified in the Jenkins security advisory at https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3769 - the exact patched version number is not independently confirmed from available input data and should be verified directly in the advisory before deployment. If immediate upgrade is not feasible, restrict Jenkins web UI access to trusted internal networks or VPN-only access to eliminate the external attack surface, which removes the network reachability that makes this CSRF exploitable remotely. Separately, verify that Jenkins' built-in crumb-based CSRF protection is enabled (it is on by default in modern Jenkins core releases via Manage Jenkins > Configure Global Security); while this does not substitute for a plugin-level fix, it reduces the overall CSRF attack surface. Disabling the Priority Sorter Plugin entirely is a viable workaround if job priority management is not operationally required.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today