Exposed Vite servers are being probed for AWS and Azure credentials
F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.
F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.
- 32,000+ scan attempts in August, up from 1,732 in prior three months
- CVE-2026-39364 (CVSS 8.2) bypasses Vite server.fs.deny file restrictions
- Affects Vite 7.1.0-7.3.1 and Vite 8.0.0-8.0.4; patch and rotate secrets
- Double-encoded path traversal used to evade WAFs and reverse proxies
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-9841 | Unauthenticated Remote Code Execution in PHPUnit eval-stdin.php | 9.8 | 100% | KEV | KEV |
| CVE-2018-14028 | In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files | 7.2 | 15% | ||
| CVE-2018-20062 | Unauthenticated Remote Code Execution in ThinkPHP-based noneCms 1.3 | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2024-45811 | Vite a frontend build tooling framework for javascript | 4.8 | 1% | ||
| CVE-2025-30208 | Unauthenticated Arbitrary File Read in Vite Dev Server via @fs Allow-List Bypass | 7.5 | 75% | PoC | |
| CVE-2025-31125 | Vite Dev Server Improper Access Control Exposes Protected Files (Actively Exploited) | 7.5 | 75% | KEVPoC ×2 | KEV |
| CVE-2026-39364 | Vite: On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200… | 8.2 | 2% | PoC |
From the original article
2 min read at csoonline.com
Attackers have opened a new front in their war on software developers: Vite servers, which they are probing for sensitive data including cloud credentials, infrastructure configuration and environment files.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.