Cybersecurity experts have recently uncovered a large-scale scanning operation targeting Vite development environments to extract sensitive cloud credentials. The campaign is designed to exploit vulnerabilities in Vite servers that are exposed to the internet, focusing on acquiring configurations and credentials from Amazon Web Services (AWS) and Microsoft Azure, as well as infrastructure state files, according to a report by F5 Labs.
Details of the Exploit
In August 2026, researchers identified a credential theft tactic leveraging a flaw designated as CVE-2026-39364, which carries a CVSS score of 8.2. This critical vulnerability allows an attacker to bypass security measures via query parameter manipulation, leading to unauthorized access to sensitive data, including files specified by server.fs.deny.
According to an advisory published by Vite in April 2026, attackers can exploit the flaw by appending specific query parameters like ?raw or ?import&raw to HTTP requests. This enables retrieval of blocked files, such as .env and *.crt, with HTTP 200 responses, compromising security restrictions intended to protect sensitive information.
Conditions for Exploitation
For an application to be vulnerable, certain conditions must be met: the Vite development server must be exposed to the network via the –host or server.host configuration option, sensitive files must reside within directories permitted by server.fs.allow, and these files must be denied by patterns set in server.fs.deny.
Typically, Vite binds to localhost by default. However, issues arise when developers expose the server using the –host flag or misconfigure Docker port mappings, potentially opening the server to wider network access. Attackers exploit this by sending HTTP GET requests to the /@fs/ endpoint, specifying a sensitive file path and adding bypass parameters to manipulate the server.fs.deny settings.
Impact and Attack Patterns
The consequences are severe, granting unauthorized access to plaintext API secrets, database passwords, and cloud administrative credentials. F5 Labs observed numerous requests exploiting the vulnerability to gather critical data such as environment configurations, AWS credentials, infrastructure state files, and Azure profiles. Additionally, system memory and environment details, including /etc/passwd and /proc/self/environ, were targeted.
Attackers used fake User-Agent headers to impersonate well-known bots like Googlebot and ClaudeBot, complicating detection. Furthermore, forged IP addresses were employed to bypass IP-based access controls, obscuring the attack’s origin.
Significantly, much of the malicious activity originated from countries including the U.S., Belgium, the Netherlands, Singapore, and Taiwan, with attackers utilizing Google Cloud Platform IP ranges to evade detection.
This ongoing threat underscores the critical need for robust security measures and vigilant monitoring of development environments to prevent unauthorized access and data breaches.
