Bitrise: Public VNC access is temporarily disabled on remote access builds and RDE sessions
CVEs mentioned
- CVE-2026-43760CVSS 8.6 highsays not affected
Only CVEs the vendor’s text names by id, or that its notice says it is not affected by. A mention is not a statement that the vulnerability caused this incident.
Affected components: ⚙️ Builds (CI)
Timeline of updates
- identified
A macOS Screen Sharing (VNC) vulnerability, CVE-2026-43760, has been announced. To protect your machines, we’ve disabled internet-facing access to VNC. SSH is unaffected and remains fully available.
We have no evidence that any customer machine was accessed as a result of this vulnerability. This is a proactive measure to reduce exposure.
You can connect to the VNC server by tunnelling it over SSH:
ssh -L 5900:localhost:5900 $SSH_ADDRESS
Then connect to
localhost:5900with a VNC client. - resolved
This incident has been resolved.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves this record existed by then and has not been changed since, by anyone, Rewindex included.
How the archive is checked, and what it cannot prove.
First version captured
In the 2026-10-17 checkpoint, timestamped by FreeTSA and DigiCert on . Record hash
e927120f2a81c374…
Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).