Exposed Vite Development Servers Targeted for AWS and Azure Credential Theft
Security researchers at F5 Labs have identified an active automated scanning campaign targeting internet-exposed Vite development servers to steal cloud credentials, environment configuration files, and Infrastructure-as-Code secrets. During August 2026, F5's honeypot infrastructure recorded 807 grouped attacks representing approximately 32,000 raw events, a significant increase from 1,732 related attempts during the preceding three months. Much of the activity targeted CVE-2026-39364, a high-severity Vite file-access control bypass vulnerability that allows unauthenticated attackers to retrieve files that should normally be protected by the server.fs.deny configuration. Attackers were observed searching for AWS credentials, Azure tokens, .env files, Terraform state files, application configuration files, and operating-system information.
CVE-2026-39364 affects Vite development servers that have been explicitly exposed to a network through options such as –host, the server.host configuration setting, or improperly configured container and cloud networking. The vulnerability allows specially constructed query parameters to bypass Vite's file-access restrictions, causing sensitive files to be returned to an unauthenticated remote requester. The Vite project rates the issue High severity with a CVSS v4.0 score of 8.2, with Vite versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 affected; the vulnerability was fixed in 7.3.2 and 8.0.5 respectively. F5 also observed attackers testing older Vite file-disclosure vulnerabilities, demonstrating that the campaign uses a broader multi-vulnerability scanning toolkit rather than relying exclusively on CVE-2026-39364.
The campaign presents significant risk because credentials exposed through development environments can provide attackers with access far beyond the Vite server itself. F5 observed attempts to retrieve AWS credential files, Azure authentication tokens, Terraform state files, environment variables, and process-environment data that could contain API keys, database credentials, cloud secrets, and infrastructure configuration. Compromise of these credentials could potentially lead to cloud account takeover, unauthorized access to production resources, data theft, infrastructure modification, or further lateral movement. F5 therefore recommends treating secrets accessible from any vulnerable Vite server that was externally reachable during the observed campaign as potentially compromised. Although CVE-2026-39364 is not currently listed in CISA's Known Exploited Vulnerabilities catalog, F5's direct honeypot telemetry demonstrates active exploitation attempts against exposed systems and justifies treating the activity as an ongoing threat.
Attack Surface
Web Application, Cloud Service, Infrastructure
Tactics
Initial Access, Credential Access, Discovery, Reconnaissance, Collection
Techniques
- T1190 – Exploit Public-Facing Application
- T1552 – Unsecured Credentials
- T1083 – File and Directory Discovery
- T1078 – Valid Accounts
- T1595.002 – Active Scanning: Vulnerability Scanning
- T1005 – Data from Local System
SuperPRO's Threat Countermeasures Procedures
- Update Vite to version 7.3.2 or later for Vite 7.x deployments, or version 8.0.5 or later for Vite 8.x deployments, to remediate CVE-2026-39364. Organizations should preferably upgrade to the latest supported Vite release available for their application branch.
- Immediately rotate AWS access keys, Azure tokens, API credentials, database passwords, and other cloud secrets that may have been stored on development systems running an externally accessible vulnerable Vite version. Where exposure cannot be ruled out, treat the credentials as potentially compromised and review their subsequent usage.
- Audit Docker, Kubernetes, cloud security groups, load balancers, ingress resources, and firewall configurations to confirm that Vite development servers are not directly reachable from the public internet or other untrusted networks.
- Configure Vite development servers to bind to localhost wherever possible and avoid using –host, server.host: true, or 0.0.0.0 on systems accessible from untrusted networks. Vite binds to localhost by default, while wildcard host configuration exposes the development service to LAN or public interfaces.
- Restrict the filesystem locations accessible to Vite using server.fs.allow and remove sensitive credentials from directories accessible to the development server. Maintain server.fs.deny rules for .env, certificates, private keys, cloud credentials, and Infrastructure-as-Code files as defense in depth, but do not rely on server.fs.deny alone because CVE-2026-39364 specifically allows attackers to bypass this control.
- Deploy Web Application Firewall or reverse-proxy detection rules for suspicious Vite query patterns, including requests containing ?raw, ?import&raw, and ?import&url&inline when they target sensitive or filesystem-backed resources. These query patterns are directly associated with the demonstrated server.fs.deny bypass. WAF controls should be treated as temporary or defense-in-depth protection rather than a substitute for upgrading.
- Monitor HTTP access logs for encoded and double-encoded traversal activity, including %252f sequences, requests to /@fs/, and attempts to retrieve sensitive paths such as .env, .aws/credentials, .azure/accessTokens.json, terraform.tfstate, terraform.tfvars, /proc/self/environ, and /proc/1/environ. F5 observed these patterns during active credential-harvesting campaigns.
- Review historical Vite and reverse-proxy logs for requests targeting known credential wordlists, particularly systems that were externally accessible before patching. Investigate successful HTTP 200 responses to requests for .env, cloud credential, Terraform, or process-environment files.
- Review AWS CloudTrail, Azure Activity Logs, IAM telemetry, and identity-provider logs for suspicious authentication, API access, privilege changes, resource creation, or unusual activity associated with credentials stored on potentially exposed Vite hosts.
- Do not place sensitive files within Vite's public directory, because Vite documentation states that files in the public directory are served without server.fs.deny filtering.
