Mass Scans Target Exposed Vite Development Servers for Cloud Secrets

Developers who expose Vite’s default localhost server to the internet are suddenly on the front page of a new threat campaign. Over the past month, F5’s honeypot sensors recorded more than 800 distinct attacks aimed at Vite instances that had been left publicly reachable.

How the Attack Works

At the heart of the operation is CVE‑2026‑39364, a high‑severity flaw that lets an unauthenticated attacker craft a GET request with special query parameters—such as ?raw, ?import&raw, or ?import&url&inline—to bypass Vite’s file‑access checks. The server then returns the requested file with a 200 status code, effectively leaking any file that should be protected.

Targeted Secrets

Once inside, the attackers run exhaustive wordlists against common secret locations: .env files, AWS credential and config files, Azure tokens, Terraform state, and serverless configuration files. They also probe /proc/self/environ and /etc/passwd for additional clues.

Who’s Behind It

Most of the malicious traffic originates from IP ranges owned by Google Cloud, with the highest activity coming from the United States, Belgium, and the Netherlands. The attackers also exploit older Vite CVEs—CVE‑2025‑30208, CVE‑2025‑31125, and CVE‑2024‑45811—showing a pattern of opportunistic exploitation.

Mitigation Steps

• Upgrade Vite to the latest release (8.0.5 or newer) to patch CVE‑2026‑39364 and related flaws.
• Never expose the dev server to the internet; keep it bound to localhost or use a reverse proxy that blocks external access.
• Block traffic to port 5173 and filter out suspicious /@fs/ requests.
• Avoid trusting crawler User‑Agent strings; enforce strict authentication or rate limiting.
• If a Vite instance is publicly exposed, rotate all cloud credentials that could have been accessed.

“The attackers are using Google Cloud IP ranges to hide behind legitimate traffic, making it harder for defenders to spot the scans,” notes F5 security researchers.