F5 Labs has documented a mass-scanning campaign against internet-exposed Vite development servers that attempts to lift cloud credentials and configuration files out of AWS and Azure deployments. The operation exploits CVE-2026-39364, a high-severity flaw that bypasses file read and access controls in Vite versions 7.1.0 through 7.3.2 and the 8.x branch before 8.0.5, disclosed on 7 April. The bug is a parameter-manipulation bypass: an unauthenticated attacker appends parameters such as ?raw, ?import&raw or ?import&url&inline to an HTTP GET request, the server fails to enforce its deny-list filtering, and it serves the target file with an HTTP 200 response in plaintext from a location that should have been out of reach. F5 detected the activity through its honeypot sensors, observing more than 800 attacks and roughly 32,000 raw events over a month. What the scanners are hunting for shows the attacker's understanding of developer environments: .env, .env.production and .env.local files; AWS credential files across several possible home directories plus AWS configuration and credential backups; Azure credentials and access tokens; Terraform state and variable files; serverless configuration and state; the process environment files /proc/self/environ, /proc/1/environ and /proc/self/cwd/.env; and /etc/passwd for a fallback inventory. The campaign also attempted traversal and encoding variants including double-encoded traversal sequences, apparently to slip past reverse proxies and WAF normalisation. Most observed activity originated from the United States, Belgium and the Netherlands, with attackers using Google Cloud IP ranges for evasion, and the most active addresses were also leveraging older access-control flaws in the same project (CVE-2025-30208, CVE-2025-31125 and CVE-2024-45811). The exposure is self-inflicted rather than a design defect: Vite binds to localhost by default, and F5 attributes the exposures to developers passing a --host flag, setting server.host, or misconfiguring Docker port mappings. Recommended mitigations are to patch, block access to port 5173, block suspicious /@fs/ requests and stop trusting crawler User-Agent strings as a trust signal; F5 names three source addresses for blocklisting. Where unpatched servers were publicly exposed, all secrets within reach should be rotated rather than merely reviewed.

• Source article