A widespread scanning campaign is targeting internet-exposed Vite development servers to steal cloud credentials and configurations, particularly for AWS and Azure deployments. The attacks leverage a high-severity vulnerability, CVE-2026-39364, which affects Vite versions 7.1.0 through 7.3.2 and the 8.x branch before 8.0.5. This flaw, disclosed on April 7, enables an unauthenticated attacker to bypass file access controls by manipulating query parameters in an HTTP GET request, allowing them to retrieve sensitive files in plaintext.
Security researchers at F5 detected these attacks through their honeypot sensors, observing over 800 attacks and approximately 32,000 raw events within a month. The exploit works by appending specific parameters like `?raw`, `?import&raw`, or `?import&url&inline` to a request. When these are present, the server fails to enforce deny-list filtering and serves the requested file with an HTTP 200 response, even if it should normally be inaccessible.
Once a system is breached, the attackers focus on extracting valuable secrets. They use extensive wordlists to search for various types of data, including `.env` files (such as `.env`, `.env.production`, and `.env.local`), AWS credential and configuration files from multiple potential home directories, Azure credentials and access tokens, Terraform state and variable files, and Serverless configuration/state files. The attackers also attempt to retrieve `/proc/self/environ`, `/proc/1/environ`, `/proc/self/cwd/.env`, and `/etc/passwd`.
The operation also incorporates traversal and encoding variants, including double-encoded traversal sequences, which are likely attempts to bypass reverse proxies or Web Application Firewall (WAF) normalization. Most of the observed malicious activity originated from IP addresses in the United States, Belgium, and the Netherlands, with attackers frequently using Google Cloud IP ranges for evasion.
Beyond CVE-2026-39364, the most active IP addresses involved in the campaign have also exploited other access control flaws in Vite. These include CVE-2025-30208, CVE-2025-31125 (which has been flagged as actively exploited), and CVE-2024-45811.
While Vite development servers are typically designed to bind to localhost, developers often expose them to the internet. This can occur through explicitly passing the `--host` flag, configuring `server.host`, or due to misconfigured Docker port mappings.
To mitigate the risk, developers are advised to update their Vite servers to the latest version, which contains patches for the exploited vulnerabilities. Additionally, it is recommended to block access through port 5173, block suspicious `/@fs/` requests, and avoid trusting crawler User-Agent strings. Specific IP addresses identified as top sources for malicious attempts, including 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, should be blocklisted. If unpatched Vite servers were publicly exposed, it is strongly recommended to rotate all secrets that could have been compromised by the vulnerable system.
