Mass scanning of Vite servers to steal cloud credentials — what is known and how to protect yourself

In August 2026, F5 Labs observed a large-scale automated scanning campaign targeting internet-exposed Vite development servers. The attackers are exploiting the CVE-2026-39364 vulnerability — an access control bypass for file restrictions that allows unauthenticated extraction of sensitive data: environment variables, AWS and Azure credentials, and infrastructure state files (Terraform, Serverless). The vulnerability affects Vite versions 7.1.0–7.3.1 and 8.0.0–8.0.4; fixes are available in versions 7.3.2 and 8.0.5. Organizations using Vite with network access to the development server should update immediately and rotate secrets if the server was exposed externally in August 2026.

Technical essence of the vulnerability

CVE-2026-39364 is a vulnerability in the Vite development server that allows unauthenticated file reads and bypass of access control lists. According to the official Vite security advisory, files that should be blocked by the server.fs.deny directive (for example, .env, *.crt) are returned with an HTTP 200 response if the request includes the ?raw, ?import&raw, or ?import&url&inline parameters. An attacker sends an HTTP GET request to the /@fs/ endpoint, specifying the path to the target file and one of the bypass parameters, after which the server returns the file contents in clear text.

The Vite advisory classifies the vulnerability as CWE-180 (incorrect order: validate before canonicalize) and CWE-284 (improper access control). The severity rating is ambiguous: the Vite advisory on GitHub assigns CVSS 8.2 (High) under CVSS v4, while F5 Labs in its report states CVSS 7.5 (High). Both scores fall into the “high” category, but the discrepancy should be taken into account when prioritizing. The entry is available in the NVD.

It is important to understand that the real attack surface is narrower than the entire Vite installation base. An application is vulnerable only when three conditions are met simultaneously:

• The Vite development server is explicitly exposed to the network — via the --host flag, the server.host setting, or incorrect port forwarding of a Docker container
• The target sensitive file is located within directories allowed by server.fs.allow
• The same file is blocked by a pattern in server.fs.deny

By default, Vite binds to localhost, which prevents remote exploitation. However, developers often expose the server to the network for testing, which creates the attack vector.

Observed campaign

According to F5 Labs, in August 2026 honeypot sensors recorded 807 attack sessions and roughly 32,000 raw events related to scanning exposed Vite servers. It should be emphasized that this is telemetry from a single observer, which confirms the presence of automated scanning and targeted reconnaissance but does not prove successful extraction of credentials or compromise of cloud accounts for specific victims. As of the time of publication, no independent confirmations of the campaign’s scale from other research organizations have been found.

The scanners iterated over a prepared list of file paths, including:

• Environment configurations: .env, .env.local, .env.production, .env.development, .env.staging
• AWS credentials: /root/.aws/credentials, /home/ec2-user/.aws/credentials
• AWS configuration and backups
• Infrastructure state files: terraform.tfstate, serverless.yml
• Azure profiles
• System data: /etc/passwd, /proc/self/environ, /proc/1/environ, /proc/self/cwd/.env

As F5 notes, the request to /proc/self/cwd/.env indicates that the attackers understand the deployment stack: this request reads the .env file relative to the process’s working directory without needing to guess the absolute path.

Evasion tactics

The attackers used fake User-Agent headers imitating legitimate web crawlers and AI bots: Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, Amazonbot. In parallel, they supplied bogus X-Forwarded-For and X-Real-IP values to bypass IP-based access lists and complicate log analysis. This creates a practical opportunity for detection: correlating requests to /@fs/ with raw/import parameters, User-Agent headers impersonating well-known bots, and suspicious forwarding headers can serve as a reliable signal of malicious activity.

According to F5, most of the traffic originated from the United States, Belgium, the Netherlands, Singapore, and Taiwan, with a significant share of addresses from Google Cloud Platform ranges (34.x and 35.x). However, this geographic distribution reflects the source infrastructure rather than the physical location or identity of the attackers. No named threat actor has been identified. F5 also notes that the same source cluster generated requests targeting CVE-2025-29927, which points to multi-framework scanning.

F5 classifies the observed behavior using MITRE ATT&CK as: T1595.002 (active scanning: vulnerabilities), T1190 (exploit public-facing application), T1552.001 (credentials in files), T1005 (data from local system), T1083 (file and directory discovery).

Indicators of compromise

IP addresses associated with the campaign (according to F5 Labs):

• 34.94.237.62
• 104.28.219.193
• 34.14.15.105
• 34.16.200.129
• 34.11.196.206

Impact assessment

The highest risk is to development teams that expose Vite servers to the network for collaboration, testing, or demos — especially in environments with access to cloud credentials. Successful exploitation can lead to leakage of API keys, database passwords, administrative credentials for cloud providers, and infrastructure state files, which in the worst case can open the way to full takeover of a cloud account.

Recommendations

1. Update Vite to versions 7.3.2, 8.0.5 or newer patch releases
2. Close network access to development, pre-production, and staging servers — they should not be reachable from the internet
3. Rotate secrets if a Vite server might have been exposed externally in August 2026: replace AWS keys, Azure tokens, database passwords, and any other credentials stored in environment files
4. Configure filtering of requests to /@fs/ with the ?raw, ?import&raw, and ?import&url&inline parameters at the WAF or reverse proxy level
5. Review logs for requests to /@fs/ with the listed parameters, especially from User-Agents that imitate search bots in combination with suspicious X-Forwarded-For headers

The key action is to immediately update Vite and cut off network access to development servers. If your server was exposed to the internet during the campaign’s active period, updating alone is not enough: you need full rotation of all secrets that could have resided in accessible directories, since the possibility that they were extracted cannot be ruled out based on the available data.