Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers

Summary

A mass-scanning campaign is actively exploiting a high-severity vulnerability (CVE-2026-39364) in Vite, a popular web development tool. Attackers are targeting internet-exposed Vite development servers to steal cloud credentials, configurations for AWS and Azure, and infrastructure state files by manipulating query parameters to bypass security restrictions. The campaign, observed in August 2026, requires specific conditions to be met for successful exploitation, including the Vite dev server being explicitly exposed to the network.

Full text

Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers Ravie LakshmananSep 15, 2026Vulnerability / Cloud Security Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The first is an automated effort aimed at internet-exposed Vite development servers that's designed to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files, per F5 Labs. The credential harvesting activity, observed in August 2026, has been found to leverage an exploit for CVE-2026-39364 (CVSS score: 8.2), a high-severity security flaw in Vite that could permit an unauthenticated attacker to bypass security restrictions via query parameter manipulation and leak sensitive data, including files specified by server.fs.deny. "On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended," Vite said in an advisory for the flaw in April 2026. Successful exploitation, however, requires three conditions to be met for an app to be deemed affected - Explicitly exposes the Vite dev server to the network using --host or server.host config option The sensitive file exists in the allowed directories specified by server.fs.allow The sensitive file is denied with a pattern that matches a file by server.fs.deny "Under default configurations, Vite binds to localhost," F5 Labs said. "When developers expose the service by passing the --host flag, setting server.host, or misconfiguring Docker container port mappings, the development server becomes directly reachable over the local network or public internet." Attackers can issue an HTTP GET request to the /@fs/ endpoint, referencing a sensitive file path and appending bypass query parameters. This causes the server to process the request, while undermining the server.fs.deny check, and ultimately return the contents of the requested file in plaintext in the HTTP response body. This can have severe implications when the request is used to target configuration directories, granting the attackers unauthorized access to plaintext API secrets, database passwords, and cloud administrative credentials. F5 said it observed several requests consistent with the flaw to conduct reconnaissance and extract the following types of data - Environment configurations AWS credentials AWS configurations and backups Infrastructure state files (e.g., terraform.tfstate and serverless.yml) Azure profiles System memory and environment details (e.g., /etc/passwd, /proc/self/environ, /proc/1/environ, and /proc/self/cwd/.env) "Probing /proc/self/cwd/.env demonstrates an understanding of the deployment stack, reading the active .env file relative to the running process without needing to guess the absolute web application path," F5 said. The requests make use of bogus User-Agent headers impersonating major web crawlers and artificial intelligence bots, like Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot. The requests also inject forged X-Forwarded-For and X-Real-IP values (e.g., 34.94.237[.]62 and 104.28.219[.]193) to get around IP-based access lists and complicate log analysis. A significant chunk of the malicious activity has originated from the U.S., Belgium, the Netherlands, Singapore, and Taiwan, with the attackers using Google Cloud Platform ranges (34.x and 35.x) to fly under the radar. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cloud security, Vulnerability, Web Security ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Critical Vulnerabilities Might Not Be Your Biggest Risk What It Took to Reach 1 Billion Build Manifests US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries Why Are So Many Security Professionals Keeping Breaches Quiet? The Economics of Dwell Time and Why AI Native SIEM Changes the Equation ⭐ Featured Resources Get the eBook: Map Enterprise AI Risk Across the Full Lifecycle Give SOC Analysts Visibility Into 90% of Attacks Within 60 Seconds Benchmark Your SOC's AI Adoption With the 2026 Security Operations Report Register for LDR516: Strategic Vulnerability and Threat Management at SANS DC Metro

Indicators of Compromise

• cve — CVE-2026-39364
• ip — 34.94.237.62
• ip — 104.28.219.193

Entities