Hackers Target Exposed Vite Servers to Steal Cloud Credentials

A mass-scanning campaign is targeting internet-exposed Vite development servers in an attempt to steal cloud credentials and configuration files for AWS and Azure deployments.

The operation exploits CVE-2026-39364, a high-severity vulnerability that allows unauthenticated attackers to bypass file access controls. The flaw affects Vite versions 7.1.0 through 7.3.2, as well as the 8.x branch prior to version 8.0.5.

Exploitation via Query Parameter Manipulation

Researchers at F5 detected the attacks using honeypot sensors, reporting more than 800 attacks and approximately 32,000 raw events over a one-month period. The vulnerability allows an attacker to manipulate query parameters in an HTTP GET request to retrieve plaintext files that should normally be protected.

By appending specific parameters such as ?raw, ?import&raw, or ?import&url&inline to a request, attackers can bypass security restrictions. This results in the server serving the target file with an HTTP 200 response, effectively granting access to sensitive data.

Once access is gained, attackers use extensive wordlists to target high-value secrets. These include:

• Environment files such as .env, .env.production, and .env.local.
• AWS credential files and configuration backups.
• Azure credentials and access tokens.
• Terraform state and variable files.
• Serverless configuration and system files like /etc/passwd.

F5 noted that the attackers also employed traversal and encoding variants, including double-encoded traversal sequences, to bypass reverse proxies or Web Application Firewalls (WAF).

Mitigation and Security Best Practices

While Vite typically binds to localhost, developers often expose the server to the internet by using the --host flag, setting server.host, or through misconfigured Docker port mappings.

To secure environments, F5 recommends that developers immediately update Vite servers to the latest version to address the exploited flaws. Additional defensive measures include:

• Blocking access through port 5173.
• Blocking suspicious /@fs/ requests.
• Avoiding trust in crawler User-Agent strings.

If any Vite servers were found to be publicly exposed while unpatched, organisations should rotate all secrets and credentials that were within reach of the vulnerable system.