Mass scanning targets exposed Vite servers for cloud secrets

Campaign targets internet-exposed Vite development servers

F5 Labs has identified a mass-scanning campaign that exploited CVE-2026-39364, a high-severity vulnerability in Vite with a CVSS score of 8.2. Observed in August 2026, the activity targeted internet-exposed Vite development servers to extract cloud credentials, configuration files and infrastructure state data.

The flaw can allow an unauthenticated attacker to bypass Vite security restrictions through query-parameter manipulation. Vite said in its April 2026 advisory that files intended to be blocked by server.fs.deny, including .env and certificate files, may be returned with HTTP 200 responses when requests use parameters such as ?raw, ?import&raw or ?import&url&inline.

Exploitation requires an affected application to expose its Vite development server to the network through the --host flag or server.host; to keep the sensitive file within directories allowed by server.fs.allow; and to deny that file through a matching server.fs.deny pattern. Under default settings, Vite binds to localhost.

Requests sought secrets, state files and process information

Attackers can send an HTTP GET request to the /@fs/ endpoint, specify a sensitive file path and add one of the bypass parameters. The server processes the request while the deny check is undermined, potentially returning the requested file as plaintext in the response body.

F5 Labs observed reconnaissance and extraction attempts aimed at environment configurations, AWS credentials and configurations, AWS backups, Azure profiles, and infrastructure files such as terraform.tfstate and serverless.yml. The requests also sought /etc/passwd, /proc/self/environ, /proc/1/environ and /proc/self/cwd/.env.

The request for /proc/self/cwd/.env is notable because it reads the active environment file relative to the running process, avoiding the need to guess an application's absolute path. Exposed configuration data can include API secrets, database passwords and cloud administrative credentials.

Traffic attempted to blend into routine web activity

The observed requests used bogus User-Agent strings impersonating Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot and Amazonbot. They also carried forged X-Forwarded-For and X-Real-IP values, a technique that can complicate log analysis and attempt to bypass IP-based access lists.

F5 Labs said a significant portion of the activity originated from the United States, Belgium, the Netherlands, Singapore and Taiwan, using Google Cloud Platform address ranges beginning with 34.x and 35.x. The practical implication for businesses is to keep Vite development servers off publicly reachable networks, review host settings and Docker port mappings, and check exposed deployments for sensitive files that could be retrieved through the vulnerable endpoint.