Critical Vite Vulnerability Exposes AWS, Azure Credentials

Key Takeaways

• Threat actors are actively exploiting a critical vulnerability in Vite development servers to steal cloud credentials and sensitive data.
• The campaign leverages CVE-2026-39364, a high-severity file disclosure flaw, alongside other access bypasses.
• Attackers are targeting AWS credentials, Azure access tokens, environment variables, and Infrastructure-as-Code secrets.
• Vite versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 are affected; patches are available in Vite 7.3.2 and 8.0.5.

A widespread automated scanning operation is currently targeting internet-exposed Vite development servers, aiming to exfiltrate a broad array of sensitive information, including AWS credentials, Azure access tokens, environment variables, and Infrastructure-as-Code (IaC) secrets.

F5’s honeypot sensors recorded a dramatic surge in this activity during August 2026, registering 807 session-grouped attacks and approximately 32,000 raw events. This represents a significant increase compared to the 1,732 Vite-related file-read events observed over the preceding three months.

The primary vector for these attacks is CVE-2026-39364, a high-severity Vite file-disclosure vulnerability disclosed in April 2026. However, attackers are also attempting to exploit older Vite access-control bypasses, indicating a sophisticated scanning infrastructure that utilizes a comprehensive exploit library rather than relying on a single flaw.

This rapid escalation in malicious activity underscores how quickly threat actors integrate newly disclosed framework vulnerabilities into automated campaigns designed to harvest cloud credentials.

Vite Server Cloud Credentials Under Siege

The Vulnerability: CVE-2026-39364

CVE-2026-39364 impacts Vite versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4. This vulnerability enables unauthenticated attackers to retrieve files that should be protected by the server.fs.deny configuration, such as .env files and various certificates.

Vite includes an internal @fs route that facilitates serving files directly from the host filesystem during development. While a deny-list mechanism is intended to prevent browsers from requesting sensitive content, specifically crafted query parameters—including ?raw, ?import&raw, and ?import&url&inline—can circumvent this protection. When these parameters are used, the server may return restricted files with an HTTP 200 OK response, effectively disclosing their contents.

Successful exploitation hinges on several conditions: the Vite development server must be publicly accessible, the target file must reside within a directory permitted by server.fs.allow, and the file must also match a rule in server.fs.deny.

By default, Vite binds to localhost. However, developers often expose it to local area networks or public interfaces through methods such as the --host option, server.host configuration, container port mappings, Kubernetes ingress rules, or misconfigured cloud security groups.

F5 observed requests that combined the @fs endpoint with various query-string bypasses, path traversal techniques, and double-encoded separators. Examples of targeted files included .env, /root/.env, /proc/self/environ, and deeply encoded paths containing %252f.

Double encoding is a technique that can help malicious requests bypass reverse proxies or web application firewalls that may normalize paths differently than the backend server, thus allowing the encoded request to reach the vulnerable server intact.

Targeted Credentials and Techniques

The scanners employ a meticulously compiled wordlist of credential files, including .env.local, .env.production, .env.staging, various AWS credential files found in common Linux user directories, AWS SSO caches, backup keys, rootkey.csv, aws-exports.js, and Amplify configuration files.

Attackers also specifically searched for Azure accessTokens.json and other credential files, along with Terraform state files, Terraform variables, Serverless Framework state, and other deployment artifacts.

A particularly notable probing technique involved requests for /proc/self/cwd/.env. This path can reveal the active application’s environment file without requiring the attacker to know its absolute installation path, making it a highly effective method for discovery.

A successful response to these probes could expose critical information such as API keys, database passwords, cloud access keys, session secrets, infrastructure addresses, and Terraform-managed resource data. Such a disclosure could easily escalate from a development server compromise to a broader cloud environment takeover.

The campaign utilizes HTTP/1.0 requests with Connection: close headers, a characteristic pattern of lightweight automated scanners. To evade detection and analysis, requests rotate forged User-Agent strings impersonating legitimate bots like Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot. Fabricated X-Forwarded-For and X-Real-IP headers are also used in an attempt to confuse log analysis or circumvent poorly implemented IP allowlists.

Attack Origins and Broader Campaigns

The majority of this activity originates from cloud-hosting infrastructure, specifically IP addresses within Google Cloud Platform’s 34.x and 35.x ranges. Geographically, the United States accounted for the highest number of recorded events (17,297), followed by Belgium (4,407), the Netherlands (4,011), Singapore (2,842), Taiwan (1,994), and Japan (1,353).

A subset of the same infrastructure responsible for the Vite attacks was also observed probing for CVE-2025-29927, a Next.js middleware authorization bypass. This suggests that the operators are simultaneously scanning for vulnerabilities across multiple web-development frameworks.

The Vite traffic also triggered signatures for CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811, all of which involve related file-access bypass techniques. Notably, CISA added CVE-2025-31125 to its Known Exploited Vulnerabilities catalog in January 2026, further confirming that exposed Vite development services are actively being targeted in real-world attacks.

What You Should Do

• Patch Immediately: Upgrade affected Vite installations to version 7.3.2, 8.0.5, or newer supported releases.
• Remove Public Exposure: Ensure all development servers, especially Vite instances, are not accessible from public-facing networks. Audit Docker Compose files, Kubernetes services, ingress configurations, reverse proxies, firewall rules, and cloud security groups for exposed development ports, particularly Vite’s default port 5173.
• Monitor Logs: Inspect HTTP access logs for requests containing /@fs/, suspicious raw or import query parameters, encoded traversal sequences (e.g., %252f), and attempts to retrieve environment, AWS, Azure, Terraform, or /proc files.
• Validate Bot Identities: Do not rely solely on User-Agent strings for bot identification. Validate crawler access using appropriate IP and reverse-DNS verification.
• Assume Compromise and Rotate Credentials: Any organization that exposed an unpatched Vite server should assume that attackers may have collected accessible secrets. Immediately revoke or rotate AWS keys, Azure tokens, database credentials, API secrets, signing keys, and Terraform-managed credentials.
• Conduct Cloud Audit: Following credential rotation, review cloud audit logs for any signs of unauthorized authentication, privilege escalation, persistence mechanisms, or unauthorized resource creation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.