In a concerning development, hackers are systematically targeting Vite development servers exposed to the internet. Their goal is to obtain sensitive AWS credentials, Azure access tokens, and other critical environment variables through a large-scale automated scanning operation.
According to data collected by F5’s honeypot sensors, the number of attacks surged to 807 session-grouped incidents with around 32,000 raw events recorded in August 2026. This marks a significant rise from the 1,732 Vite-related file-read events logged in the preceding three months.
Exploitation of Vite Vulnerability
The primary vulnerability being exploited is identified as CVE-2026-39364, a serious file-disclosure flaw in Vite’s development framework published earlier in April 2026. Attackers are also leveraging older Vite bypass exploits, indicating a comprehensive exploit toolkit.
This rapid increase in malicious activity underscores how quickly cybercriminals adapt and exploit newly identified framework vulnerabilities for automated credential theft campaigns.
Understanding the Vite File-Disclosure Flaw
The CVE-2026-39364 vulnerability affects specific versions of Vite, namely 7.1.0 to 7.3.1 and 8.0.0 to 8.0.4. It allows unauthorized attackers to access files that should be restricted by the server.fs.deny configuration, such as .env files and certificates.
During development, Vite uses an internal @fs route to serve files from the host filesystem. Special query parameters can bypass the deny-list protection, enabling the server to return restricted files with a standard HTTP 200 response.
Attackers exploit this flaw by reaching Vite development servers over the network, targeting files in directories allowed by server.fs.allow, and matching server.fs.deny rules. Developers often expose Vite to LAN or public interfaces through various configurations, increasing vulnerability.
Mitigation and Defensive Measures
Organizations are advised to upgrade to Vite version 7.3.2, 8.0.5, or later releases to mitigate these risks. It’s crucial to remove development servers from public networks and thoroughly audit Docker, Kubernetes, and cloud security configurations.
Security teams should closely monitor HTTP logs for suspicious requests involving /@fs/, raw or import query parameters, and encoded path traversals. Verifying bot identities through IP and reverse-DNS checks rather than relying solely on User-Agent strings is also recommended.
For those who had unpatched Vite servers exposed, it’s prudent to assume possible credential thefts. Revoking or rotating AWS keys, Azure tokens, and other sensitive credentials should be prioritized, alongside reviewing cloud audit logs for unauthorized activities.
The incident highlights the importance of proactive security measures and regular updates to protect against evolving cyber threats. Organizations must stay vigilant and responsive to such vulnerabilities to safeguard their digital assets.
