Hackers Exploit Exposed Vite Dev Servers to Steal Cloud Credentials
Hackers are running a mass-scanning campaign against internet-exposed Vite development servers in an effort to steal cloud credentials and configuration data from AWS and Azure deployments. The operation exploits CVE-2026-39364, a high-severity vulnerability affecting Vite versions 7.1.0 through 7.3.2 and the 8.x branch before 8.0.5. The flaw lets an unauthenticated attacker manipulate query parameters in an HTTP GET request to bypass file read and access controls and retrieve files in plaintext from locations that should be off-limits.
Technology company F5 detects the attacks through its honeypot sensors, recording more than 800 attacks and roughly 32,000 raw events over a month. When parameters such as ?raw, ?import raw, or ?import url inline are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response. After breaching a system, the scanners hunt for valuable secrets using extensive wordlists covering .env files, AWS credential and configuration files, Azure credentials and access tokens, Terraform state files, serverless configurations, and /proc/self/environ. The actors also try traversal and encoding variants, including double-encoded sequences, to evade reverse proxies and WAF normalization.
Most of the malicious activity originates from the United States, Belgium, and the Netherlands, with attackers using Google Cloud IP ranges for evasion. The most active addresses also leverage other Vite access control flaws, including CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811. Although Vite normally binds to localhost, developers often expose it online through the --host flag, the server.host setting, or misconfigured Docker port mappings. F5 recommends updating Vite servers to the latest version, blocking access through port 5173, and filtering suspicious traffic to prevent credential theft.