Thousands of internet-facing Vite development servers are being aggressively scanned by attackers seeking cloud credentials and configuration data. Starting in early August 2026, automated campaigns targeted exposed servers to extract sensitive files—like .env, certificates, Terraform state, and Azure and AWS secrets—using publicly disclosed Vite flaws and access-control bypasses.
Vulnerabilities fueling the attack
The scanner sweep makes heavy use of CVE-2026-39364, a serious file-disclosure vulnerability affecting versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 of Vite. The flaw allows unauthenticated attackers to fetch files that should be blocked by server.fs.deny—using crafted paths with query strings like ?raw, ?import&raw, and ?import&url&inline—breaking Vite’s denial rules and returning private files with HTTP 200 responses.
Although Vite defaults to binding to localhost, developers often open it to outside access via flags like –host, container port exposure, Kubernetes ingress, or misconfigured firewalls and hosts. Attackers combined path traversal, double-encoding tricks, misuse of /@fs routes, and encoded separators to sneak past proxies and security controls. Targets included environment files in root or user directories, AWS and Azure credential caches, Terraform or Serverless framework state files, and even Linux process-environment files.
Scale and scope of the campaign
Data from honeypot sensors shows a huge jump in scan activity: in August alone, 807 grouped attack sessions and around 32,000 raw file-read attempts were logged. That contrasts sharply with just 1,732 events over the three months before. Most traffic came from cloud-provider IP ranges—especially Google Cloud Platform addresses. The U.S., Belgium, Netherlands, Singapore, Taiwan, and Japan featured among the top locations for exposed servers.
Request patterns included deceptive User-Agent headers impersonating Googlebot, Amazonbot, ClaudeBot, GPTBot, PerplexityBot, and others—likely to confuse logs or evade superficial bot filters. Attackers also tried older, related vulnerabilities across frameworks like Next.js, indicating the infrastructure backing these scans pulls from a wider exploit set.
Defensive steps
Organizations running affected versions of Vite need to upgrade immediately to 7.3.2, 8.0.5, or later releases. Equally important is removing any development servers from public network exposure—checking Kubernetes configurations, ingress rules, reverse proxy setups, firewall policies, and cloud security groups for port 5173 or other development‐oriented endpoints.
Security teams should sift through HTTP logs for suspicious request patterns—especially those asking for the /@fs route, or using raw/import query params, double-encoded traversal sequences, or hints of attempts to access .env, /proc, or cloud credential files. User-Agent strings shouldn’t be trusted on their own; IP verification or reverse DNS checks can help spot spoofed traffic.
If a server has been exposed, assume secrets may be compromised. Best practice calls for revoking or rotating all possibly exposed credentials—API keys, signing keys, cloud access keys, Terraform state items—and auditing logs for signs of privilege escalation or unexpected resource creation.
This rises beyond just a Vite issue: it’s a red flag for how development tools with insecure defaults, once exposed, quickly become vectors for cloud compromise. Teams need to assume file-disclosure bugs get weaponized fast.
