CVE-2026-86819: Waves Central local privilege escalation via Improper XPC Client Authentication in macOS
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Waves Central for macOS (privileged helper service)to a version that resolves this vulnerability.Fixed in 17.0 - Compensating control
Until upgraded, restrict local access to the privileged helper service by limiting which local authenticated users/processes can interact with the helper’s XPC interface (e.g., via host access controls/ACLs) to reduce the chance an attacker can satisfy the helper’s XPC client certificate-chain equality check.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a local, authenticated user with the ability to execute code within a vendor-signed process. It is not described as remotely exploitable.
What access does successful exploitation provide?
An attacker who passes the helper's XPC client check can cause the privileged helper to execute a script with root privileges, resulting in local privilege escalation.
Which versions are affected, and what is the remediation?
The issue is fixed in Waves Central 17.0. Upgrade to version 17.0 or later if available.