CVE-2026-90894

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

• CWE-78
• CWE-88
• CWE-269

• https://kb.parallels.com/en/131168
• https://www.parallels.com/products/desktop/

Published

Sep 14, 2026

Last Modified

Sep 15, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90880A security flaw has been discovered in D-Link DSL-3782 2016-…7.4
• CVE-2026-90881A weakness has been identified in D-Link DIR-882 up to 20260…5.3
• CVE-2026-9089The ConnectWise Automate™ Agent does not fully verify the au…8.8
• CVE-2026-90890ASRock Polychrome SYNC/RGB software utility developed by ASR…5.5
• CVE-2026-90891ASRock Polychrome SYNC/RGB software utility developed by ASR…5.5
• CVE-2026-90893MISP contains a Cross-Site Request Forgery (CSRF) vulnerabil…5.1
• CVE-2026-90895Affected versions of MISP’s interactive CLI shell implement …8.4
• CVE-2026-90896Missing Authentication for Critical Function (CWE-306) in th…8.2
• CVE-2026-90898Bifrost registers MCP clients through its management API. A …9.8
• CVE-2026-9090Casdoor versions 2.362.0 and earlier contain a vulnerability…9.1
• CVE-2026-9091Casdoor versions 2.362.0 and earlier contain a logic flaw in…5.3
• CVE-2026-90919LightLLM through 1.2.0 contains a remote code execution vuln…9.8