---
id: CVE-2026-90894
title: "Parallels Desktop runs\_prl_disp_service\_as root"
summary: "Parallels Desktop runs\_prl_disp_service\_as root. Local clients reach it on the world-writable socket\_/var/run/prl_disp_service.socket.\_PrlSrv_LoginLocal\_accepts peer credentials. No Parallels signature. No admin group.\n\n\n\nAfter login,\_Pr…"
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
  - CWE-88
  - CWE-269
vendor: Parallels
product: Parallels Desktop
affected:
  - desktop 26.4.0
published: '2026-09-14'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:31:11.370'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90894'
references:
  - url: 'https://kb.parallels.com/en/131168'
    label: reefs@jfrog.com
  - url: 'https://www.parallels.com/products/desktop/'
    label: reefs@jfrog.com
tags:
  - nvd
  - cve.org
epss: 0.00168
epssPercentile: 0.05331
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T10:23:23.018106Z'
ingestedAt: '2026-09-14T15:23:07.463Z'
---

## Overview

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group.



After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.