Attackers Scan Vite Servers to Steal Cloud Credentials via CVE-2026-39364

Attackers are mass-scanning internet-exposed Vite development servers to steal environment files, API keys, database passwords and cloud administrator credentials. F5 Labs recorded 807 grouped attacks and approximately 32,000 events during one month, describing a sharp increase from normal background activity. The campaign targets Vite installations that developers have unintentionally made accessible online.

The activity exploits CVE-2026-39364, a vulnerability in Vite’s internal `@fs` file-serving route. Vite’s `server.fs.deny` setting is intended to block sensitive files, but query parameters such as `?raw` or `?import&raw` can bypass the restriction. According to F5, an unauthenticated request can then retrieve restricted system and configuration files over HTTP, returning their contents in plaintext with an HTTP 200 response. Scanners search for `.env` files, AWS and Azure credentials, Terraform state files and paths such as `/proc/self/cwd/.env`.

CVE-2026-39364 affects Vite 7.1.0 up to versions before 7.3.2 and 8.0.5. The article says to upgrade to Vite 7.3.2, 8.0.5 or later, avoid exposing development servers to the internet, bind Vite to localhost and check Docker port mappings. Organisations should also rotate credentials that may have been accessible. Related flaws are being used in the same campaign; the article identifies CVE-2025-31125 as the only one in the group currently listed in CISA’s Known Exploited Vulnerabilities catalogue.