Mass Exploitation of Vite Servers Targets Cloud Credentials via CVE-2026-39364
Attackers are actively scanning internet-exposed Vite development servers, exploiting CVE-2026-39364 to steal sensitive AWS and Azure cloud credentials and environment variables.
A significant automated scanning campaign is targeting internet-exposed Vite development servers, with threat actors actively seeking to exfiltrate AWS credentials, Azure access tokens, and other sensitive cloud secrets. F5 honeypot sensors observed a dramatic surge in activity during August 2026, recording 807 session-grouped attacks and approximately 32,000 raw events, a stark contrast to the mere 1,732 Vite-related file-read events logged in the preceding three months. This surge is primarily attributed to the exploitation of CVE-2026-39364, a high-severity Vite file-disclosure vulnerability that was publicly disclosed in April 2026.
The attackers are not solely relying on CVE-2026-39364, as they have also been observed testing older Vite access-control bypass vulnerabilities. This suggests a broad exploit library is being employed by the scanning infrastructure, indicating a sophisticated and adaptable threat actor. The rapid escalation in exploitation attempts highlights the speed at which threat actors integrate newly discovered framework vulnerabilities into their automated campaigns for harvesting cloud credentials.
CVE-2026-39364 specifically affects Vite versions ranging from 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4. The vulnerability allows unauthenticated attackers to bypass intended file-disclosure restrictions, enabling them to retrieve sensitive files such as .env configuration files and digital certificates. Vite's internal @fs route is designed to serve files from the host filesystem during development, but a flaw in its server.fs.deny configuration allows specially crafted query parameters, including ?raw, ?import&raw, and ?import&url&inline, to circumvent these protections. Successful exploitation results in the server returning restricted files with an HTTP 200 OK response.
For exploitation to occur, several conditions must be met: the Vite development server must be accessible over a network, the targeted file must reside within a directory permitted by server.fs.allow, and the file must match a rule in the server.fs.deny configuration. While Vite typically binds to localhost by default, developers can inadvertently expose it to wider networks through options like --host, server.host configuration, container port mappings, Kubernetes ingress rules, or misconfigured cloud security groups.
The observed exploitation attempts are sophisticated, combining the @fs endpoint with query-string bypasses, path traversal, and double-encoded separators. Examples include requests targeting .env, /root/.env, and /proc/self/environ, often using deeply encoded paths like %252f. This double encoding is a technique used to evade detection by reverse proxies or web application firewalls that may normalize paths differently from the backend Vite server.
Attackers are utilizing a comprehensive credential wordlist to locate sensitive files. This list includes common environment file names like .env.local, .env.production, and .env.staging, as well as AWS credential files found in typical Linux user directories, AWS SSO caches, and backup key files. They are also searching for Azure access tokens, Terraform state files, Serverless Framework state, and other deployment artifacts. Notably, probes for /proc/self/cwd/.env aim to reveal the active application's environment file without needing to know its absolute installation path.
Successful exploitation could lead to the exposure of critical information such as API keys, database passwords, cloud access keys, session secrets, and infrastructure details. This could transform a seemingly minor development server vulnerability into a full-blown cloud compromise. The campaign's traffic patterns, including HTTP/1.0 requests with Connection: close and forged User-Agent strings impersonating various bots, indicate the use of lightweight, automated scanners designed to evade detection and analysis.
Organizations running affected Vite versions are strongly advised to upgrade to Vite 7.3.2, 8.0.5, or newer supported releases. Furthermore, development servers should be removed from public-facing networks. Security teams must audit network configurations, including Docker Compose files, Kubernetes services, ingress rules, reverse proxies, firewalls, and cloud security groups, for any exposed development ports, especially Vite's common port 5173. Any organization that exposed an unpatched Vite server should assume that accessible secrets may have been compromised and should proceed to revoke or rotate all potentially exposed credentials, including AWS keys, Azure tokens, and database passwords, followed by a thorough review of cloud audit logs.