Mass-scanning campaign targets exposed Vite servers for cloud secrets

A mass-scanning campaign is targeting internet-exposed Vite development servers in attempts to steal cloud credentials and configurations from AWS and Azure deployments.

The operation uses CVE-2026-39364, a high-severity vulnerability disclosed on April 7. It bypasses file read and access controls in Vite 7.1.0 through 7.3.2 and in the 8.x branch before 8.0.5. An unauthenticated attacker can manipulate query parameters in an HTTP GET request and retrieve plaintext files from restricted locations. Parameters including ?raw, ?import&raw, and ?import&url&inline can make the server return a target file with HTTP 200.

F5 detected the activity through honeypot sensors, recording more than 800 attacks and about 32,000 raw events over a month. The campaign also tried traversal and encoding variants, including double-encoded sequences, and focused on secrets after compromising systems. Most observed activity came from the United States, Belgium, and the Netherlands, while attackers used Google Cloud IP ranges for evasion.

The most active IP addresses were 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206. F5 said the same actors also used CVE-2025-30208, CVE-2025-31125, which is flagged as actively exploited, and CVE-2024-45811. Developers often expose Vite through --host, server.host, or Docker port mappings, despite Vite normally binding to localhost. F5 recommends updating affected servers and blocking port 5173 and suspicious /@fs/ requests.