NewsPublished 14 Sep 2026

Hackers target exposed Vite dev servers to steal AWS, Azure secrets

Source Bleeping Computer

Mentions 4 CVEs

Mentioned vulnerabilities

cloud

Description

A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments. [...]

Impact

Successful exploitation allows attackers to access sensitive cloud credentials and configuration files from AWS and Azure environments, potentially leading to unauthorized cloud resource access and compromise. The vulnerability enables unauthenticated attackers to bypass intended file access restrictions and retrieve plaintext files that should be protected. This can result in credential theft and subsequent cloud infrastructure compromise.

Defensive guidance

A fix is available by updating Vite to the latest version that addresses CVE-2026-39364 and related vulnerabilities. Developers should avoid exposing Vite servers publicly by not using the --host flag or misconfigured Docker port mappings that bind Vite to non-localhost interfaces. Blocking access to port 5173 and suspicious /@fs/ requests is recommended. Additionally, blocklisting known malicious IP addresses (e.g., 34.14.15.105, 34.16.200.129, 34.11.196.206) can reduce exposure. If unpatched Vite servers were exposed, rotate all secrets accessible to those systems. Follow vendor advisories for updates and further guidance.

Summary

The threat exploits CVE-2026-39364 in Vite development servers, allowing unauthenticated attackers to bypass file read/access controls by manipulating query parameters such as ?raw, ?import&raw, or ?import&url&inline in HTTP GET requests. This flaw affects Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5. Attackers use this to retrieve sensitive files including environment files (.env), AWS and Azure credential/configuration files, Terraform state files, and other secrets. The campaign involves mass scanning and attempts to evade detection using traversal and double-encoded sequences. The activity was detected by F5, which observed over 800 attacks and 32,000 events in a month. Attackers also exploited other Vite vulnerabilities (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811). The exposure often results from developers misconfiguring Vite to be accessible beyond localhost.

References

bleepingcomputer.com/news/security/hackers-target-exposed-vite-dev-servers-to-steal-aws-azure-secrets/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 14 Sep 2026, 16:17 UTC

References

Community reviews

Related threats