Vite Dev Servers Exposed to Mass Scanning Campaigns Targeting AWS and Azure Secrets
A concerning trend has emerged in the cybersecurity landscape, as hackers are leveraging a previously disclosed vulnerability in Vite development servers to steal sensitive cloud credentials and configurations from AWS and Azure deployments. The mass-scanning campaign, detected by technology company F5 through its honeypot sensors, is attempting to bypass security restrictions and retrieve files in plaintext from exposed Vite servers.
The exploit, which targets the CVE-2026-39364 vulnerability, allows an unauthenticated attacker to manipulate query parameters in an HTTP GET request. This enables them to bypass file read/access controls in affected versions of Vite (7.1.0 through 7.3.2) and the 8.x branch before 8.0.5. The flaw was disclosed on April 7, but it appears that hackers have since developed a way to exploit it en masse.
F5 observed more than 800 attacks and approximately 32,000 raw events over a month, with most of the malicious activity originating from the United States, Belgium, and the Netherlands. The attackers are using Google Cloud IP ranges for evasion, making it challenging to pinpoint their exact location. Notably, the operation also tried traversal and encoding variants to get past reverse proxies or WAF normalization.
The scanning campaign is focused on stealing sensitive data, including environment files (such as .env, .env.production, and .env.local), AWS credential files, AWS configuration files and credential backups, Azure credentials and access tokens, Terraform state and variable files, serverless configuration/state, and others. The attackers are using extensive wordlists to identify valuable secrets.
To mitigate this threat, Vite developers should update their servers to the latest version, which addresses the exploited flaws. It is also recommended to block access through port 5173, as well as suspicious /@fs/ requests. Additionally, developers should avoid trusting crawler User-Agent strings and ensure that they do not expose their development servers online.
If unpatched Vite servers were publicly exposed, it is crucial to rotate all secrets within the reach of the vulnerable system immediately. This will prevent potential data breaches and minimize the impact of the attack.
As the cybersecurity landscape continues to evolve, it is essential for developers and organizations to stay vigilant and take proactive measures to protect their systems against emerging threats. By staying informed and up-to-date with the latest security best practices, we can reduce the risk of falling victim to these types of attacks.
Source: Bleeping Computer — 2026-09-14