The threat exploits CVE-2026-39364 in Vite development servers, allowing unauthenticated attackers to bypass file read/access controls by manipulating query parameters such as ?raw, ?import&raw, or ?import&url&inline in HTTP GET requests. This flaw affects Vite versions 7.1.0 through 7.3.2 and 8.x before 8.0.5. Attackers use this to retrieve sensitive files including environment files (.env), AWS and Azure credential/configuration files, Terraform state files, and other secrets. The campaign involves mass scanning and attempts to evade detection using traversal and double-encoded sequences. The activity was detected by F5, which observed over 800 attacks and 32,000 events in a month. Attackers also exploited other Vite vulnerabilities (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811). The exposure often results from developers misconfiguring Vite to be accessible beyond localhost.

Successful exploitation allows attackers to access sensitive cloud credentials and configuration files from AWS and Azure environments, potentially leading to unauthorized cloud resource access and compromise. The vulnerability enables unauthenticated attackers to bypass intended file access restrictions and retrieve plaintext files that should be protected. This can result in credential theft and subsequent cloud infrastructure compromise.

A fix is available by updating Vite to the latest version that addresses CVE-2026-39364 and related vulnerabilities. Developers should avoid exposing Vite servers publicly by not using the --host flag or misconfigured Docker port mappings that bind Vite to non-localhost interfaces. Blocking access to port 5173 and suspicious /@fs/ requests is recommended. Additionally, blocklisting known malicious IP addresses (e.g., 34.14.15.105, 34.16.200.129, 34.11.196.206) can reduce exposure. If unpatched Vite servers were exposed, rotate all secrets accessible to those systems. Follow vendor advisories for updates and further guidance.