Attackers exploit Vite flaw to steal AWS and Azure secrets

Attackers are actively scanning the internet for exposed Vite development servers and using a recently disclosed file access bypass to steal cloud credentials from Amazon Web Services and Microsoft Azure deployments. Vite is a free tool that developers use to build and test JavaScript websites and applications, and its built-in development server lets them preview changes before publishing. This matters to website owners and IT teams because development servers are often run by members of the same team and may be left exposed by accident, even though they can contain real credentials for cloud services. The vulnerability behind the campaign is CVE-2026-39364, a high-severity flaw that affects Vite versions 7.1.0 through 7.3.2, as well as the 8.x branch before 8.0.5. It was made public on April 7.

The flaw allows an unauthenticated attacker, meaning someone who has not logged in or supplied any password, to send a specially crafted HTTP GET request. An HTTP GET request is the normal type of request a browser sends when you visit a web page, and the attacker simply adds certain query parameters, the extra text after a question mark in a web address, to that request. According to F5, a technology company that runs decoy servers to attract and record malicious traffic, the server fails to enforce its deny-list filtering when requests contain parameters such as ?raw, ?import&raw or ?import&url&inline. It then serves the target file with an HTTP 200 status, which means the request succeeded and the file was returned in plaintext, even though it should normally be out of the attacker's reach.

F5 detected the activity through honeypot sensors, which are decoy systems set up to attract and record attacks. Over a one-month period, the company observed more than 800 attacks and approximately 32,000 raw events. The scanning focused on stealing valuable secrets by using extensive wordlists, which are long lists of common file names and paths that attackers try one after another. The targets included environment files such as .env, .env.production and .env.local, which are plain text files that store configuration details and secret credentials. The attackers also looked for AWS credential files in several possible home directories, AWS configuration files and credential backups, Azure credentials and access tokens, Terraform state and variable files, serverless configuration and state files, and special system paths like /proc/self/environ, /proc/1/environ, /proc/self/cwd/.env and /etc/passwd.

The operation also attempted directory traversal and encoding variants, including double-encoded traversal sequences. Directory traversal is a technique where an attacker uses dot-dot sequences to move outside a directory, and double encoding is used to bypass security tools that normalize or filter such requests, such as reverse proxies or web application firewalls. Most of the observed malicious activity originated from the United States, Belgium and the Netherlands, and the attackers used Google Cloud IP ranges to hide their true origin. The most active IP addresses also leveraged other access control flaws in Vite: CVE-2025-30208, CVE-2025-31125, which is flagged as actively exploited, and CVE-2024-45811.

Vite normally binds to localhost, which means it is only reachable from the developer's own computer and not from the public internet. But F5 researchers note that developers often expose it online by passing the --host flag, setting the server.host option, or using misconfigured Docker port mappings, which can accidentally make the server reachable from anywhere. To protect against this campaign, F5 recommends updating Vite servers to the latest version, which addresses the exploited flaws. Developers should also block access through port 5173, the default port Vite uses, block suspicious /@fs/ requests, and avoid trusting crawler User-Agent strings, which can be faked. The top source IP addresses for the malicious attempts are 34.14.15[.]105, 34.16.200[.]129 and 34.11.196[.]206, and F5 says they should be blocklisted. If an unpatched Vite server was publicly exposed, the recommendation is to rotate all secrets that were within reach of the vulnerable system.

Rotating a secret means generating a new password or access key and updating every place that uses the old one, so that stolen credentials become useless. The source does not say whether any stolen credentials have already been used to access cloud accounts. For teams that manage internet-facing development infrastructure, this campaign is a reminder that even temporary tools can become an entry point. AEU-I, AEU's security-first IT and consulting service, helps organizations assess their exposure and apply patches to reduce such risks.