Hackers Scan Exposed Vite Servers for AWS, Azure, and Deployment Secrets

Attackers are conducting a large-scale scanning campaign against internet-accessible Vite development servers, attempting to extract cloud credentials, access tokens, environment files, and infrastructure-management data.

F5 detected more than 800 attacks and roughly 32,000 raw events over a one-month observation period. The main target is CVE-2026-39364, a high-severity file-access vulnerability affecting recent Vite releases, but scanners are also testing several older access-control bypasses.

The activity targets a dangerous configuration mistake: exposing a development server that would ordinarily listen only on localhost. Organizations can create that exposure through Vite’s --host option, the server.host setting, or incorrect Docker port mappings.

Query parameters turn file requests into a security bypass

CVE-2026-39364 allows an unauthenticated remote attacker to manipulate query parameters in HTTP GET requests and circumvent Vite’s restrictions on reading files. The vulnerability has a CVSS score of 7.5 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

The affected releases are:

• Vite 7.1.0 through 7.3.2
• Vite 8.x versions before 8.0.5

The vulnerability was disclosed on April 7. Its CISA Known Exploited Vulnerabilities status has not been specified.

Attackers are using query constructions including:

?raw
?import&raw
?import&url&inline

On a vulnerable server, these parameters can interfere with the checks intended to prevent access to protected or out-of-scope files. Instead of rejecting the request, Vite may return the requested content in plaintext with an HTTP 200 response.

The scanning also includes path-traversal and encoding variations. Some requests use double-encoded traversal sequences, which may survive normalization by a reverse proxy or web application firewall before reaching Vite.

This is not code execution by itself. The immediate security impact is confidentiality loss, but the stolen material can provide everything needed for a broader cloud, deployment, or host compromise.

Scanners search for cloud keys and infrastructure state

The campaign uses extensive wordlists rather than focusing on a single file. Common targets include .env, .env.production, .env.local, and other environment-variable files that developers frequently use to hold application secrets.

Attackers are also probing multiple home-directory paths for AWS configuration files, credentials, and backup copies. Azure credentials and access tokens are another priority.

Infrastructure-as-code data is particularly valuable. Terraform state files can expose resource identifiers, provider configuration, internal architecture, and secrets stored in state. Terraform variable files may contain credentials used to provision or modify cloud resources. Serverless configuration and state files can reveal similar deployment information.

Requests observed during the campaign also targeted operating-system paths such as:

/proc/self/environ
/proc/1/environ
/proc/self/cwd/.env
/etc/passwd

The /proc environment files may disclose secrets passed to application or container processes at runtime. /etc/passwd generally does not contain password hashes, but it can reveal account names, home directories, service identities, and other details useful for follow-on attacks.

A successful request could expose long-lived access keys, temporary cloud credentials, CI/CD secrets, deployment keys, internal paths, and application configuration. Attackers could then use those credentials independently of the Vite server, making later activity appear in cloud services rather than on the initially affected host.

Older Vite flaws remain in the attackers’ toolkit

The most active source addresses did not limit their requests to CVE-2026-39364. F5 also saw attempts associated with CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811.

CVE-2025-30208 has a CVSS score of 5.3. It concerns Vite’s @fs mechanism, which is supposed to restrict access to files outside the configured serving allow list. Query forms such as ?raw?? and ?import&raw?? can bypass that control because trailing separators are handled inconsistently during request processing.

The NVD product entry identifies vitejs vite < 4.5.10, while the more detailed affected-release information lists fixes in:

• 4.5.10
• 5.4.15
• 6.0.12
• 6.1.2
• 6.2.3

CVE-2025-31125, also scored 5.3, uses related query-string forms such as ?inline&import and ?raw?import to expose files that should not be served. Its fixes are available in Vite 4.5.11, 5.4.16, 6.0.13, 6.1.3, and 6.2.4.

CISA added CVE-2025-31125 to its KEV catalog on January 22, 2026. US federal agencies had a remediation deadline of February 12, 2026. CISA’s required action is to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or stop using the product when mitigation is unavailable.

That KEV entry establishes that exploitation of Vite file-access controls predates the newly reported campaign. The current scanning shows attackers continuing to test multiple generations of the same general weakness against whatever version responds.

CVE-2024-45811 has a CVSS score of 4.8. Exact affected versions and fixes for that flaw are not known from the available campaign information.

Cloud infrastructure obscures the operators’ location

Much of the observed traffic was associated with the United States, Belgium, and the Netherlands. However, some requests came through Google Cloud address ranges, limiting the value of geolocation for attribution.

The three most active malicious source addresses identified by F5 were:

34.14.15[.]105
34.16.200[.]129
34.11.196[.]206

F5 recommends blocking these addresses. Defenders should treat them as initial indicators rather than a complete detection set, because scanning infrastructure can be replaced quickly.

Requests that resemble ordinary crawlers should not automatically be trusted. An attacker can assign a familiar or benign-looking User-Agent header without changing the underlying exploit traffic.

Exposed servers require patching and credential rotation

Administrators should upgrade Vite to the latest available release and verify that the installed version fixes every relevant vulnerability. For CVE-2026-39364, that means moving beyond Vite 7.3.2 or using Vite 8.0.5 or later within the documented branches.

Development servers should not be directly accessible from the internet. Teams should review --host, server.host, container networking, Docker port publishing, firewall rules, and temporary testing environments that may have remained online.

External access to TCP port 5173, used by the Vite development server in this campaign, should be blocked unless there is a documented operational requirement. Security teams should also monitor requests containing /@fs/, the known query combinations, encoded traversal sequences, and probes for cloud or environment files.

Patching alone is insufficient if a vulnerable server was previously public. Organizations should assume that readable secrets may have been collected without leaving evidence beyond ordinary HTTP access logs.

Potentially exposed AWS credentials, Azure tokens, CI/CD secrets, environment variables, Terraform credentials, Serverless deployment secrets, and application keys should be revoked or rotated. Cloud audit logs should then be checked for unexpected authentication, resource discovery, privilege changes, or use from unfamiliar infrastructure.

Terraform and Serverless artifacts also require integrity review. Attackers who obtained working credentials may have changed cloud resources without modifying the Vite host itself.

The key question is not simply whether exploitation appears in local logs. It is whether the development server could return sensitive files while it was reachable. If the answer is yes, incident response should proceed as a credential-exposure investigation.