Threat actors are conducting a large-scale campaign against publicly exposed Vite development servers with the goal of exfiltrating cloud credentials and deployment configurations from AWS and Azure environments.

The attacks exploit CVE-2026-39364, a high-severity flaw that circumvents file read access controls in Vite versions 7.1.0 through 7.3.2 and the 8.x branch prior to 8.0.5. The vulnerability was made public on April 7 and permits unauthenticated attackers to manipulate HTTP GET request parameters to bypass security filters and retrieve plaintext files from restricted locations.

F5 identified the campaign through its honeypot infrastructure, documenting over 800 individual attacks generating approximately 32,000 events during a one-month observation window.

When specific parameters such as ?raw, ?import&raw, or ?import&url&inline are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response

F5

Once inside a compromised system, attackers systematically searched for high-value secrets using comprehensive wordlists targeting multiple categories of sensitive data:

  • .env, .env.production, .env.local, and other environment files
  • AWS credential files from multiple possible home directories
  • AWS configuration files and credential backups
  • Azure credentials and access tokens
  • Terraform state and variable files
  • Serverless configuration and state
  • /proc/self/environ, /proc/1/environ, and /proc/self/cwd/.env
  • /etc/passwd

The operation also employed traversal and encoding techniques, including double-encoded traversal sequences, apparently designed to evade reverse proxies or Web Application Firewall normalization.

The majority of malicious activity originated from the United States, Belgium, and the Netherlands, with attackers routing traffic through Google Cloud IP ranges to mask their origins.

The most frequently active source IP addresses also exploited additional access control vulnerabilities in Vite: CVE-2025-30208, CVE-2025-31125 (documented as actively exploited), and CVE-2024-45811.

Protecting Vite deployments

While Vite typically listens only on localhost by default, F5 researchers note that developers frequently make it accessible over the network by using the --host flag, configuring server.host, or through improperly mapped Docker ports.

F5 recommends upgrading Vite servers to the latest version to patch the exploited vulnerabilities. Additional protective measures include restricting access to port 5173, filtering out suspicious /@fs/ requests, and disregarding crawler User-Agent strings.

The three most prolific source IP addresses are 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, which organizations should add to their blocklists.

For organizations that operated unpatched Vite servers on the public internet, immediate rotation of all credentials accessible from those systems is strongly advised.