Organization

F5 Labs

1 mentions in 7 days · 1 in 30 days · 1 total · first seen Sep 15, 2026 · last 2d ago

Timeline1 articles

Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers

Mass-scanning campaign exploits CVE-2026-39364 in exposed Vite dev servers to steal AWS/Azure credentials, .env files, and Terraform state.

F5 Labs documented an August 2026 credential-harvesting campaign exploiting CVE-2026-39364 (CVSS 8.2), a Vite flaw allowing unauthenticated attackers to bypass server.fs.deny via query parameters like ?raw and ?import&raw. Attackers issue GET requests to /@fs/ endpoints to retrieve .env files, AWS and Azure credentials, terraform.tfstate, serverless.yml, and /proc data from dev servers exposed via --host or misconfigured Docker port mappings. Requests impersonate crawlers like Googlebot, ClaudeBot, and GPTBot, forge X-Forwarded-For headers, and largely originate from GCP ranges in the US, Belgium, Netherlands, Singapore, and Taiwan.

The Hacker NewsSep 15, 11:12 UTC · 2d agoExploit / PoC in the wild 4 sources CVE-2026-393641

Related CVEsby mentions

CVE-2026-393648.22%
Vite is a frontend tooling framework for JavaScript.
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
· vitejs vite · vitejs vite\+ PoC —

Appears with

product AWS 1 product Azure 1 product Terraform 1 product Vite dev server 1 vendor Amazon Web Services 1 vendor F5 Labs 1 vendor Microsoft 1 vendor Vite 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.