ATTACKERS are mass-scanning the internet for exposed Vite development servers and exploiting CVE-2026-39364 to retrieve cloud credentials and configuration files. F5 Labs recorded 807 grouped attacks and about 32,000 events over one month. The campaign targets secrets including `.env` files, AWS and Azure credentials, database passwords, API keys and Terraform state files.
Vite’s development server uses an internal `@fs` route to serve files, while the `server.fs.deny` setting is intended to block sensitive paths. CVE-2026-39364 bypasses that protection through query parameters such as `?raw` or `?import&raw`, allowing unauthenticated attackers to obtain restricted files over HTTP in plaintext with a 200 response. Probes reportedly also target `/proc/self/cwd/.env`. The flaw affects Vite 7.1.0 up to versions before 7.3.2 and 8.0.5; the article gives a CVSS score of 7.5, while its summary table lists 8.2 under CVSSv4.
Vite users should update to 7.3.2, 8.0.5 or later, avoid exposing development servers to the internet, bind them to localhost and check Docker port mappings. Organisations should investigate reachable servers and rotate credentials that may have been exposed. The campaign also uses related flaws, including CVE-2025-30208, CVE-2024-45811 and CVE-2025-31125; the article says only CVE-2025-31125 is currently listed in CISA’s Known Exploited Vulnerabilities catalogue.