Cybersecurity firm **F5** has uncovered a sophisticated mass-scanning campaign targeting exposed **Vite** development servers. The attackers are exploiting **CVE-2026-39364**, a critical vulnerability that allows unauthenticated bypass of file read/access controls, to steal cloud credentials and configurations from **AWS** and **Azure** environments. **F5** detected over 800 attacks and approximately 32,000 raw events within a month through its honeypot sensors, indicating a significant and active threat. ## The Vulnerability: CVE-2026-39364 **CVE-2026-39364**, disclosed on April 7, affects **Vite** versions 7.1.0 through 7.3.2, as well as the 8.x branch before 8.0.5. This high-severity flaw enables an unauthenticated attacker to manipulate query parameters in an HTTP GET request to bypass security restrictions and retrieve plaintext files that should ordinarily be inaccessible. According to **F5**, "When specific parameters such as `?raw`, `?import&raw`, or `?import&url&inline` are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response." ## Post-Exploitation Tactics Once a system is breached, the attackers employ extensive wordlists to scan for and exfiltrate valuable secrets. Their targets include: * `.env`, `.env.production`, `.env.local`, and other environment files * **AWS** credential files from various possible home directories * **AWS** configuration files and credential backups * **Azure** credentials and access tokens * **Terraform** state and variable files * Serverless configuration/state * `/proc/self/environ`, `/proc/1/environ`, and `/proc/self/cwd/.env` * `/etc/passwd` **F5** also observed attempts to bypass security measures like reverse proxies and Web Application Firewalls (WAFs) through traversal and encoding variants, including double-encoded traversal sequences. ## Attack Origins and Additional Exploits The majority of the malicious activity originated from the United States, Belgium, and the Netherlands. Attackers are leveraging **Google Cloud** IP ranges, likely for evasion purposes. The most active IP addresses involved in this campaign have also been observed exploiting other **Vite** access control flaws, including **CVE-2025-30208**, **CVE-2025-31125** (which has been flagged as actively exploited by **CISA**), and **CVE-2024-45811**. ## Protecting Your Vite Deployments While **Vite** typically binds to `localhost`, **F5** researchers note that developers frequently expose it online by using the `--host` flag, setting `server.host`, or through misconfigured **Docker** port mappings. This exposure creates the attack surface for such campaigns. To mitigate the risk, **F5** recommends several crucial steps: * **Update Vite Servers:** Immediately update **Vite** servers to the latest version to patch all known exploited flaws. * **Block Port 5173:** Restrict external access to port 5173, which **Vite** commonly uses. * **Filter Suspicious Requests:** Block suspicious `/@fs/` requests, as these are often indicative of exploitation attempts. * **User-Agent Scrutiny:** Avoid blindly trusting crawler `User-Agent` strings. * **Block Malicious IPs:** Add the following IP addresses to your blocklist: `34.14.15[.]105`, `34.16.200[.]129`, and `34.11.196[.]206`. * **Rotate Secrets:** If unpatched **Vite** servers were publicly exposed, it is imperative to rotate all secrets and credentials potentially compromised by the vulnerable system.