A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments.
The operation leverages an exploit for CVE-2026-39364, a high-severity vulnerability that allows bypassing file read/access controls in Vite versions 7.1.0 through 7.3.2, as well as the 8.x branch before 8.0.5.
The flaw was disclosed on April 7 and allows an unauthenticated attacker to manipulate query parameters in an HTTP GET request to bypass security restrictions and retrieve files in plaintext from locations that should normally be out of their reach.
Technology company F5 detected the attacks through its honeypot sensors, observing more than 800 attacks and approximately 32,000 raw events over a month.
“When specific parameters such as ?raw, ?import&raw, or ?import&url&inline are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response,” F5 explains.
After breaching a system, the scanning focused on valuable secrets by using extensive wordlists for the following types of data:
- .env, .env.production, .env.local, and other environment files
- AWS credential files from several possible home directories
- AWS configuration files and credential backups
- Azure credentials and access tokens
- Terraform state and variable files
- Serverless configuration/state
- /proc/self/environ, /proc/1/environ, and /proc/self/cwd/.env
- /etc/passwd
F5 notes that the operation also tried traversal and encoding variants, including double-encoded traversal sequences, apparently to get past reverse proxies or WAF normalization.
Most of the observed malicious activity originated from the United States, Belgium, and the Netherlands, with the attackers using Google Cloud IP ranges for evasion.
The most active IP addresses also leveraged other access control flaws in Vite: CVE-2025-30208, CVE-2025-31125 (flagged as actively exploited), and CVE-2024-45811.
How to protect Vite
Although Vite normally binds to localhost, F5 researchers say that developers often expose it online through passing the –host flag, setting the server.host, or misconfigured Docker port mappings.
The technology company recommends updating Vite servers to the latest version, which addresses the exploited flaws. Developers should also block access through port 5173, block suspicious /@fs/ requests, and avoid trusting crawler User-Agent strings.
The top sources for the malicious attempts are 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, which should be blocklisted.
If unpatched Vite servers were publicly exposed, it is recommended to rotate all secrets in the reach of the vulnerable system.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
