Exposed Vite development servers face reported mass scans for cloud secrets

Scanning for credentials through a file-access flaw

The report says attackers are exploiting CVE-2026-39364, a high-severity Vite vulnerability that can bypass file read and access controls through manipulated HTTP GET query parameters. It says the scans sought environment files, AWS credential and configuration files, Azure credentials and access tokens, Terraform data, and serverless configuration or state files. F5 said its honeypot sensors recorded more than 800 attacks and about 32,000 raw events over a month.

The Vite access-control flaw had been disclosed, with affected versions identified as Vite 7.1.0 through 7.3.2 and 8.x before 8.0.5.

A reported mass-scanning operation is now attempting to exploit the flaw against internet-exposed Vite development servers and retrieve cloud credentials and configuration files.

Development servers are commonly intended for local use, but publicly exposed instances can place deployment credentials and configuration data within reach if the reported exploitation is occurring. The report also describes attempts using traversal and encoding variants to get past reverse proxies or web application firewall normalization.