Mass scanning campaign targets Vite development servers for cloud credentials

Coverage from Bleeping Computer indicates a widespread scanning campaign is actively exploiting a vulnerability in Vite development servers to steal cloud credentials and configurations from AWS and Azure deployments.

The operation utilizes an exploit for CVE-2026-39364, a critical flaw affecting Vite versions 7.1.0 through 7.3.2 and the 8.x branch before 8.0.5, according to F5. This vulnerability allows unauthenticated attackers to bypass file access controls by manipulating HTTP GET requests, enabling them to retrieve sensitive files. F5 detected over 800 attacks and approximately 32,000 events in a month, with attackers focusing on environment files, cloud credentials, Terraform configurations, and serverless settings.

The campaign also leveraged other Vite vulnerabilities, including CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811. Most malicious activity originated from the United States, Belgium, and the Netherlands, using Google Cloud IP ranges for evasion. Developers are advised to update Vite to the latest version, block port 5173, and avoid exposing Vite publicly. If servers were exposed, rotating all secrets is recommended.

Source: Bleeping Computer