Mass Scanning Targets Exposed Vite Servers to Steal AWS Keys and Azure Tokens
Attackers mass-scanned exposed Vite dev servers exploiting CVE-2026-39364 to read .env files and steal AWS keys and Azure tokens, per F5 Labs honeynet data.
Honeynet telemetry recorded 807 session-grouped attacks and roughly 32,000 raw events in August 2026 against exposed Vite development servers. CVE-2026-39364 (CVSS 7.5) is an unauthenticated file-read flaw in Vite 7.1.0 through 7.3.2 and 8.0.5 that bypasses server.fs.deny via query parameters like ?raw and ?import&raw to return files in plaintext. Attackers also probed older Vite flaws CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811, and used wordlists to locate .env files, AWS credential files, Azure token stores, and Terraform state across Linux, container, and web paths. Exposed secrets could enable lateral movement or full cloud account takeover.
- CVE-2026-39364 (CVSS 7.5) bypasses server.fs.deny in Vite 7.1.0-7.3.2 and 8.0.5
- Honeynets logged 807 attacks and ~32,000 events in August 2026
- Wordlists target .env files, AWS credentials, Azure tokens, terraform.tfstate
- Older Vite flaws CVE-2025-30208, CVE-2025-31125, CVE-2024-45811 also probed
- Exposed secrets risk cloud account takeover and lateral movement
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-45811 | Vite a frontend build tooling framework for javascript | 4.8 | 1% | ||
| CVE-2025-30208 | Unauthenticated Arbitrary File Read in Vite Dev Server via @fs Allow-List Bypass | 7.5 | 75% | PoC | |
| CVE-2025-31125 | Vite Dev Server Improper Access Control Exposes Protected Files (Actively Exploited) | 7.5 | 75% | KEVPoC ×2 | KEV |
| CVE-2026-39364 | Vite: On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200… | 8.2 | 2% | PoC |
From the original article
2 min read at gbhackers.com
In August 2026, automated threat activity targeting exposed Vite development servers increased significantly. Attackers aimed to extract cloud credentials, environment files, and infrastructure state data by exploiting a critical file-read vulnerability known as CVE-2026-39364. Honeynet telemetry recorded 807 session-grouped attacks and approximately 32,000 raw events during the monthly analysis period.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.