Large-Scale Cyberattack Targets Exposed Vite Servers to Steal Cloud Credentials
In August 2026, security researchers at F5 detected a surge in automated attacks targeting internet-exposed Vite development servers, aiming to harvest AWS credentials, Azure access tokens, environment variables, and Infrastructure-as-Code (IaC) secrets. The campaign exploited CVE-2026-39364, a high-severity file-disclosure vulnerability in Vite versions 7.1.0–7.3.1 and 8.0.0–8.0.4, allowing unauthenticated attackers to bypass security controls and retrieve sensitive files.
F5’s honeypot sensors recorded 807 session-grouped attacks and 32,000 raw events in August alone a dramatic increase from just 1,732 Vite-related file-read events over the prior three months. Attackers leveraged the vulnerability by sending crafted requests to Vite’s internal @fs route, combining query-string bypasses (e.g., ?raw, ?import&raw), path traversal, and double-encoded separators to access restricted files. Targets included .env files, AWS credential directories, Azure accessTokens.json, Terraform state files, and /proc/self/environ, which exposes an application’s environment without requiring its absolute path.
The campaign’s infrastructure also tested older Vite access-control bypasses and probed for vulnerabilities in other frameworks, including CVE-2025-29927 (Next.js middleware bypass) and CVE-2025-31125 (a Known Exploited Vulnerability per CISA). Attackers used forged User-Agent strings (e.g., Googlebot, ClaudeBot) and spoofed X-Forwarded-For headers to evade detection, while most activity originated from Google Cloud Platform IPs (34.x, 35.x ranges). The U.S. saw the highest volume of attacks (17,297 events), followed by Belgium, the Netherlands, Singapore, Taiwan, and Japan.
Exposed Vite servers often misconfigured via --host flags, container port mappings, or cloud security-group errors remain prime targets. Successful exploitation could grant attackers API keys, database passwords, cloud access credentials, and IaC secrets, enabling broader cloud compromise. Organizations are advised to upgrade to Vite 7.3.2 or 8.0.5+, remove development servers from public networks, and audit logs for suspicious requests targeting sensitive files. Compromised credentials, including AWS keys and Azure tokens, should be revoked and rotated immediately.
Source: https://cybersecuritynews.com/vite-servers-under-attack/
Vitec Software Group cybersecurity rating report: https://www.rankiteo.com/company/vitec
"id": "VIT1789410399",
"linkid": "vitec",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'location': ['U.S.',
'Belgium',
'Netherlands',
'Singapore',
'Taiwan',
'Japan'],
'type': 'Organizations with exposed Vite servers'}],
'attack_vector': 'Exploiting file-disclosure vulnerability (CVE-2026-39364) '
'in exposed Vite servers',
'data_breach': {'data_exfiltration': 'Yes',
'file_types_exposed': ['.env files',
'AWS credential directories',
'Azure accessTokens.json',
'Terraform state files',
'/proc/self/environ'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['AWS credentials',
'Azure access tokens',
'Environment variables',
'IaC secrets',
'Database passwords',
'API keys']},
'date_detected': '2026-08',
'description': 'In August 2026, security researchers at F5 detected a surge '
'in automated attacks targeting internet-exposed Vite '
'development servers, aiming to harvest AWS credentials, Azure '
'access tokens, environment variables, and '
'Infrastructure-as-Code (IaC) secrets. The campaign exploited '
'CVE-2026-39364, a high-severity file-disclosure vulnerability '
'in Vite versions 7.1.0–7.3.1 and 8.0.0–8.0.4, allowing '
'unauthenticated attackers to bypass security controls and '
'retrieve sensitive files.',
'impact': {'data_compromised': 'AWS credentials, Azure access tokens, '
'environment variables, IaC secrets, database '
'passwords, API keys',
'operational_impact': 'Potential broader cloud compromise due to '
'stolen credentials',
'systems_affected': 'Internet-exposed Vite development servers'},
'initial_access_broker': {'entry_point': 'Exploiting CVE-2026-39364 in Vite '
'servers'},
'investigation_status': 'Ongoing (detected via F5 honeypot sensors)',
'lessons_learned': 'Exposed Vite servers misconfigured via --host flags, '
'container port mappings, or cloud security-group errors '
'are prime targets. Organizations must ensure development '
'servers are not publicly accessible and audit for '
'vulnerabilities.',
'motivation': 'Harvesting cloud credentials (AWS, Azure), environment '
'variables, and IaC secrets',
'post_incident_analysis': {'corrective_actions': ['Upgrade Vite to patched '
'versions',
'Remove development servers '
'from public networks',
'Rotate compromised '
'credentials'],
'root_causes': 'Misconfigured Vite servers exposed '
'to the internet, unpatched '
'vulnerabilities (CVE-2026-39364)'},
'recommendations': ['Upgrade to Vite 7.3.2 or 8.0.5+',
'Remove development servers from public networks',
'Audit logs for suspicious requests targeting sensitive '
'files',
'Revoke and rotate compromised credentials (AWS keys, '
'Azure tokens)'],
'references': [{'source': 'F5 security researchers'}],
'response': {'recovery_measures': 'Revoke and rotate compromised credentials '
'(AWS keys, Azure tokens)',
'remediation_measures': 'Upgrade to Vite 7.3.2 or 8.0.5+, remove '
'development servers from public '
'networks, audit logs for suspicious '
'requests',
'third_party_assistance': 'F5 security researchers'},
'title': 'Large-Scale Cyberattack Targets Exposed Vite Servers to Steal Cloud '
'Credentials',
'type': 'Cyberattack',
'vulnerability_exploited': ['CVE-2026-39364',
'CVE-2025-29927',
'CVE-2025-31125']}