{"id":"CVE-2026-90894","title":"Parallels Desktop runs prl_disp_service as root","summary":"Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group.\n\n\n\nAfter login, Pr…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78","CWE-88","CWE-269"],"vendor":"Parallels","product":"Parallels Desktop","affected":["desktop 26.4.0"],"published":"2026-09-14","updated":"2026-09-18","sourceUpdated":"2026-09-18T19:31:11.370","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90894","references":[{"url":"https://kb.parallels.com/en/131168","label":"reefs@jfrog.com"},{"url":"https://www.parallels.com/products/desktop/","label":"reefs@jfrog.com"}],"tags":["nvd","cve.org"],"epss":0.00148,"epssPercentile":0.0442,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-14T10:23:23.018106Z"},"ingestedAt":"2026-09-14T15:23:07.463Z","slug":"CVE-2026-90894","body":"## Overview\n\nParallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group.\n\n\n\nAfter login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf \"%1\" -C \"%2\", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}