Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix
JFrog disclosed CVE-2026-90894, a 7.8-rated local privilege escalation in Parallels Desktop for Mac, patched only in version 27, which Intel Macs cannot install.
JFrog researcher Yuval Moravchick disclosed CVE-2026-90894 (dubbed ParaShells, CVSS 7.8), a local privilege escalation in Parallels Desktop for Mac that lets non-admin users run code as root. The root-level prl_disp_service listens on a world-writable socket, and argument injection into a tar command via QProcess::splitCommand and the --use-compress-program option yields code execution as root, demonstrated on Parallels Desktop 26.4.0 build 57513 on Apple silicon. The fix appears in version 27.0.0, but Parallels Desktop 27 requires Apple silicon, leaving Intel Macs on the 26.x line with no build JFrog describes as fixed. No exploitation in the wild has been reported and Parallels has not published a statement.
- Root prl_disp_service exposed a world-writable socket accepting unsigned local logins
- Argument injection into tar via --use-compress-program yields code execution as root
- JFrog demonstrated the attack on Parallels Desktop 26.4.0 on Apple silicon
- Fix ships only in version 27, which Intel Macs cannot install
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-90894 | Local Root Privilege Escalation in Parallels Desktop via tar Argument Injection Parallels Desktop on macOS runs its prl_disp_service daemon as root and exposes it on the world-writable Unix socket /var/run/prl_disp_service.socket, where PrlSrv_LoginLocal authenticates clients purely on peer credentials without checking for a Parallels signature or administrator group membership. Once connected, any local user can call PrlSrv_InstallAppliance and supply an appliance folder path (sVmParentPath) that gets embedded in the command string tar -xf "%1" -C "%2"; because Qt's QProcess::splitCommand re-splits the string into words, an embedded quote closes the argument early and turns leftover text into attacker-chosen tar flags. macOS tar's --use-compress-program option then executes the named program, giving the attacker arbitrary code execution as root — a full local privilege escalation from any unprivileged account on the Mac. All Macs running an affected Parallels Desktop build (the advisory does not specify version ranges) with additional local user accounts are exposed. No public proof of concept is known and the CVE is not in CISA's KEV catalog, so there is no evidence of in-the-wild exploitation at this time. Do: Update Parallels Desktop to the newest available release as soon as the vendor ships a fix — no patched version is named in this advisory, so check the Parallels security bulletin directly. Until patched, treat any Mac running Parallels Desktop with local untrusted or shared accounts (e.g., guest, student lab, or kiosk logins) as exposed to full root compromise, and restrict local account creation on those machines. Monitor prl_disp_service for unexpected child processes, particularly tar invocations carrying --use-compress-program or odd -C paths from appliance installs. | 7.8 | — |
| masslikely millions of Macs (Parallels Desktop is the leading commercial macOS virtualization product; no affected-version install counts published) |
Full article1,281 words · extracted from thehackernews.com · click to collapse
Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac, software company JFrog said this week.
The attack needs code already running on the machine as a normal user, so it does not work over the network. JFrog says the fix is in Parallels Desktop 27, a version that Intel Macs cannot install.
Yuval Moravchick, who leads JFrog's vulnerability research team, published the finding on Tuesday and calls it ParaShells. The flaw is tracked as CVE-2026-90894, an identifier JFrog assigned itself, and JFrog rates it 7.8 out of 10.
Parallels Desktop runs Windows and Linux inside virtual machines on a Mac. It installs a background service called prl_disp_service that runs as root, because its work includes setting up host networking and unpacking virtual machine packages.
The flaw is on the Mac side of the product, so the machine at risk is the Mac itself rather than the virtual machines on it.
On the machine JFrog tested, the socket that the service listens on was world-writable, meaning any program on the Mac could connect to it. The login call that follows, PrlSrv_LoginLocal, checks only the credentials the kernel reports for the connecting process. It needs no Parallels code signature and works for an account that is not an administrator.
To install a virtual machine appliance, the service builds its unpack command as one line of text, tar -xf "%1" -C "%2". It then splits that text back into separate arguments using Qt's QProcess::splitCommand.
The caller chooses part of that text, because it picks the folder the new virtual machine goes into. A double quote inside the folder name closes the quoting early, so whatever the attacker put after it becomes extra options for tar instead of part of a path.
The option JFrog used was --use-compress-program, which tells macOS tar to hand the archive to another program first. Because tar is running as root here, that program runs as root too. JFrog's test script wrote a passwordless sudo rule and opened a root shell.
JFrog demonstrated this on Parallels Desktop 26.4.0, build 57513, on a Mac with an Apple silicon chip. It says a normal install already provides everything the attack needs: the product installed, the service running with its socket present, and a low-privileged local account. No virtual machine has to be running.
The company did not check every build. "We did not regression-test every older build for this writeup," it said, telling readers instead: "Treat any Desktop install that still exposes the same InstallAppliance extract template and world-writable dispatcher socket as in scope."
JFrog also said the App Store edition may start its services differently, while describing the underlying risk as the same kind of problem. It reports no attacks using the flaw, and Parallels has published nothing about it.
The reason a local flaw matters here, JFrog said, is that code running as a normal user is common on these machines. A malicious Homebrew formula, a poisoned npm install script, or a compromised build job would each qualify, as would one weak account on a shared lab or training Mac.
The Fix, and Which Build Has It
JFrog says the change that fixes the flaw is in Parallels Desktop 27. Its advisory lists everything below 27.0.0 as affected, its writeup names 27.0.0 as the fixed version, and the CVE record lists 27.0.0 as unaffected.
The dates do not line up. JFrog's own disclosure timeline gives 1 September 2026 as the day the fix shipped in 27.0.0, but Parallels' release notes put 27.0.0 on 25 August 2026 and 27.0.1 on 1 September 2026.
Installing the newest release on that line covers both readings, because 27.0.1, build 58670, shipped after both dates. Parallels has not published a statement about CVE-2026-90894, so there is no vendor record indicating which build incorporates the change.
Parallels says it does not discuss vulnerabilities until a fix has been released publicly. Its list of security fixes, which maps each flaw to the version that repairs it, has not been reviewed since May 2025 and does not include this one.
Who Cannot Install It
Parallels Desktop 27 needs a Mac with an Apple silicon chip. Its system requirements list Apple silicon only for the processor and macOS Sonoma 14.7 or newer for the operating system. On earlier releases of macOS, including Ventura 13, the installer sets up an older version of the product instead.
Parallels removed Intel Mac support in version 27 and says the change follows Apple's plans rather than its own. macOS 26 Tahoe was the last version of macOS built for Intel Macs and macOS 27 is Apple silicon only, so a product built for macOS 27 cannot install on Intel hardware.
Intel users are told to stay on Parallels Desktop 26. "Parallels Desktop 26 fully supports Intel-based Mac computers today, and that will not change," the company wrote on 25 August, three weeks before this flaw became public, adding that Intel users can keep using version 26 and "expect future security and maintenance updates."
That line does not have this fix, according to JFrog. "Hosts that stay on the 26.x line, including 26.4.2, do not have that extract change," its advisory says. JFrog does not say it tested 26.4.1 or 26.4.2, and its writeup says it did not check older builds.
Parallels' release notes for version 26 describe no such fix either. The newest build on that line, 26.4.2, came out on 8 September 2026, and its notes list one change, for a deployment problem in the Enterprise edition.
Those notes are brief and usually state only that an update "addresses the overall stability and security issues," so they do not rule out a repair that was never documented.
A Mac that cannot run version 27 therefore has no build that JFrog describes as fixed. Parallels has not said whether the change will reach version 26, and nothing it has published sets a date.
| Product line | Newest build | Has the extract change | Can install it |
|---|---|---|---|
| Parallels Desktop 27 | 27.0.1 (58670), 1 September 2026 | Yes, per JFrog, which names 27.0.0 | Apple silicon Macs on macOS Sonoma 14.7 or newer |
| Parallels Desktop 26 | 26.4.2 (57518), 8 September 2026 | No, per JFrog | Intel and Apple silicon Macs |
How to Check, and What to Do Now
Two read-only commands show whether a Mac is exposed. The first reports the installed version; the second reports whether the service socket is open to every local process.
- defaults read "/Applications/Parallels Desktop.app/Contents/Info" CFBundleShortVersionString
- ls -l /var/run/prl_disp_service.socket
JFrog says a socket showing srwxrwxrwx on a build at or near 26.4.0 should be treated as exposed until a patched build is confirmed. Both commands show exposure only, and neither shows whether anyone has used the flaw.
Until every machine is on a fixed build, JFrog's advice is to limit who can log in locally, because any local account on a vulnerable install can reach the service. It also suggests listing every Mac in the organization that has Parallels Desktop on it.
Administrators who push updates through device management should check their version rules first. Parallels warns that a policy which sends out new major versions automatically will try to install version 27 on Intel Macs and fail, and it advises keeping those machines on version 26.
None of the published material says whether installing a fixed build removes access an attacker has already taken. JFrog notes that an attacker who reaches root can keep a foothold through launchd, which a product update would not clear.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/parallels-desktop-flaw-lets-non-admin.html