Attackers Exploit Vite Flaw to Steal AWS and Azure Secrets
Summary
F5 observed more than 800 attacks and about 32,000 events targeting exposed Vite servers through CVE-2026-39364, with attempts to access cloud credentials and other secrets. Developers should update Vite, restrict access, and rotate exposed secrets.
Key points
- The campaign targets internet-exposed Vite development servers and exploits CVE-2026-39364 to bypass file-read access controls.
- The flaw affects Vite 7.1.0 through 7.3.2 and 8.x versions before 8.0.5; attackers can manipulate HTTP GET query parameters to retrieve files.
- Targets include environment files, AWS credentials and configuration, Azure tokens, Terraform data, and server environment files.
- F5 reported more than 800 attacks and approximately 32,000 raw events detected by honeypot sensors over one month.
- F5 observed traversal and encoding variants and activity from Google Cloud IP ranges; the most active sources also used other Vite access-control flaws.
- Recommended steps include updating Vite, restricting port 5173, blocking suspicious /@fs/ requests, and rotating secrets accessible to exposed, unpatched servers.
- F5 identified 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206 as top sources and recommended blocklisting them.
Article Details
- Vulnerability Types
- Unauthorized file read through an access-control bypass
- Severity
- High
- Affected Versions
- Vite 7.1.0 through 7.3.2
- Vite 8.x before 8.0.5
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict access through port 5173.
- Block suspicious /@fs/ requests.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 34[.]11[.]196[.]206 | Source IP identified by F5 as one of the top sources of malicious attempts; recommended for blocklisting. |
| IPV4 | 34[.]14[.]15[.]105 | Source IP identified by F5 as one of the top sources of malicious attempts; recommended for blocklisting. |
| IPV4 | 34[.]16[.]200[.]129 | Source IP identified by F5 as one of the top sources of malicious attempts; recommended for blocklisting. |
MITRE ATT&CK
T1005 · Data from Local SystemThe exploit is used to retrieve local files such as configuration files, Terraform data, and /etc/passwd from vulnerable servers.T1190 · Exploit Public-Facing ApplicationThe campaign exploits CVE-2026-39364 against internet-exposed Vite development servers.T1552.001 · Credentials In FilesAttackers request environment and credential files, including .env files and AWS credential files, to obtain secrets.
CVE
CVE-2024-45811The most active IP addresses also leveraged other access control flaws in Vite: CVE-2025-30208, CVE-2025-31125 (flagged as actively exploited), and CVE-2024-45811.CVE-2025-30208The most active IP addresses also leveraged other access control flaws in Vite: CVE-2025-30208, CVE-2025-31125 (flagged as actively exploited), and CVE-2024-45811.CVE-2025-31125The most active IP addresses also leveraged other access control flaws in Vite: CVE-2025-30208, CVE-2025-31125 (flagged as actively exploited), and CVE-2024-45811.CVE-2026-39364A mass-scanning campaign is exploiting CVE-2026-39364 in exposed Vite development servers to steal cloud credentials, configuration files, and other secrets from AWS and Azure environments.
Products
AWSA mass-scanning campaign is exploiting CVE-2026-39364 in exposed Vite development servers to steal cloud credentials, configuration files, and other secrets from AWS and Azure environments.AzureA mass-scanning campaign is exploiting CVE-2026-39364 in exposed Vite development servers to steal cloud credentials, configuration files, and other secrets from AWS and Azure environments.TerraformThe campaign targets .env files, AWS credentials, Azure tokens, and Terraform data.ViteA mass-scanning campaign is exploiting CVE-2026-39364 in exposed Vite development servers to steal cloud credentials, configuration files, and other secrets from AWS and Azure environments.
Countries
BelgiumMost of the observed malicious activity originated from the United States, Belgium, and the Netherlands, with the attackers using Google Cloud IP ranges for evasion.NetherlandsMost of the observed malicious activity originated from the United States, Belgium, and the Netherlands, with the attackers using Google Cloud IP ranges for evasion.United StatesMost of the observed malicious activity originated from the United States, Belgium, and the Netherlands, with the attackers using Google Cloud IP ranges for evasion.