Vite CVE-2026-39364 Exploitation: Exposed Dev Servers Targeted for AWS and Azure Secrets

Internet-exposed Vite development servers are facing mass scanning designed to uncover cloud credentials and infrastructure secrets. F5 Labs recorded 807 session-grouped attacks and roughly 32,000 raw events during August 2026. The activity included probes matching Vite CVE-2026-39364, alongside attempts targeting older Vite file-access flaws. Attackers systematically requested .env files, AWS credentials, Azure data, Terraform state files and process environment data.

Vite CVE-2026-39364 is a high-severity file-read vulnerability that can bypass server.fs.deny through crafted query parameters. Vite 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4 are affected. Versions 7.3.2 and 8.0.5 contain the fix. The Vite advisory assigns the vulnerability a CVSS v4.0 score of 8.2.

Importantly, F5’s telemetry confirms scanning and attempts to retrieve sensitive files. The available reporting does not establish that every request succeeded or that specific AWS or Azure accounts were subsequently compromised.

Vite CVE-2026-39364 at a Glance

How Vite CVE-2026-39364 Bypasses server.fs.deny

CVE-2026-39364 allows unauthenticated attackers to bypass Vite’s server.fs.deny restrictions with crafted query parameters. Exploitation requires a network-accessible development server and specific filesystem conditions.

Vite uses server.fs.deny to prevent its development server from serving sensitive files. Its default deny list covers files such as .env, certificates, private keys and package-manager configuration files.

However, CVE-2026-39364 can bypass this restriction under specific conditions. By appending query parameters such as ?raw, ?import&raw, or ?import&url&inline, an unauthenticated attacker can retrieve files protected by server.fs.deny with an HTTP 200 response.

An affected application must meet three conditions:

• Network exposure: The Vite development server is exposed through --host or server.host.
• Permitted filesystem location: The requested file exists within directories permitted by server.fs.allow.
• Denied file pattern: The file matches a pattern configured under server.fs.deny.

Vite uses localhost as the default value for server.host. Setting it to 0.0.0.0 or true can make the server listen on additional interfaces. Therefore, network exposure is an important prerequisite rather than an inherent property of every Vite installation.

Why the Scanners Are Looking for Cloud and IaC Secrets

F5’s telemetry shows that the campaign goes well beyond checking whether a Vite server responds.

The scanning infrastructure cycled through lists of potentially valuable files. Targets included .env variants and AWS credential files across several common user directories. Attackers also probed for Azure data, Terraform state, serverless configuration and process environment information.

Examples included:

• .env, .env.local and .env.production
• AWS credential and configuration files
• Azure credential and access-token data
• Terraform state files
• serverless configuration
• /proc/self/environ
• /etc/passwd

F5 also observed double-encoded traversal sequences. The researchers assessed that attackers used these techniques to bypass request normalization by intermediate reverse proxies or web application firewalls.

This targeting matters because development environments can contain secrets used by build, deployment and cloud workflows. Exposure of a credential does not automatically mean a cloud account was compromised. However, a valid exposed credential could provide another access path depending on its permissions and validity.

What F5 Actually Observed in the Vite Scanning Campaign

F5’s August telemetry shows that the scanning extended across internet-exposed developer tooling and included probes matching CVE-2026-39364.

Additionally, the activity generated signatures associated with older Vite access-control vulnerabilities, including CVE-2025-30208, CVE-2025-31125 and CVE-2024-45811.

That distinction is important for incident response.

The evidence supports saying that exposed Vite systems were actively scanned and probed for sensitive files. It does not establish that every target returned those files. Nor does the available F5 report document subsequent privilege escalation, lateral movement or persistence inside specific AWS or Azure environments.

How to Mitigate Vite CVE-2026-39364 on Exposed Dev Servers

Organizations should address both the vulnerable Vite deployment and any secrets that could have been accessible while the server was exposed.

1. Upgrade Vite: Update affected deployments to Vite 7.3.2 or 8.0.5 or later. Teams should perform the upgrade through their existing npm, dependency-management or software-deployment workflow.
2. Restrict network exposure: Remove unnecessary --host or server.host configurations that expose Vite beyond the intended network boundary. Where remote access is unnecessary, keep the development server bound to localhost.
3. Audit logs: Review Vite, reverse-proxy and relevant network logs for requests containing ?raw, ?import&raw or ?import&url&inline. Investigate systems that received suspicious requests while running an affected Vite version.
4. Rotate potentially exposed secrets: Rotate AWS or Azure credentials, access tokens and other secrets that may have been accessible through .env files, Terraform state or other exposed configuration data.

Teams should also review how development servers become externally reachable. Removing unnecessary exposure reduces the attack surface, while log analysis and credential rotation help address potential exposure that occurred before remediation.

Featured resource

Why XDR Is Stronger With UEM

See how combining UEM with XDR can connect proactive endpoint hygiene with faster threat investigation and containment.

Download the whitepaper

How Hexnode Supports Endpoint Investigation After Vite Exposure

The primary remediation for CVE-2026-39364 remains upgrading Vite and restricting unnecessary development-server exposure. Hexnode can complement these measures with endpoint administration, investigation and containment workflows.

The responsibilities remain distinct. Patch and restrict Vite at the development layer, then use endpoint controls to investigate and contain suspicious activity where relevant.

Treat Exposed Development Services as Part of the Attack Surface

When organizations expose development servers, CVE-2026-39364 gives attackers a practical way to discover sensitive secrets through Vite’s access-control failure.

The campaign’s targeting is particularly important. The scanners did not simply check Vite versions. They searched for .env files, cloud credentials, Terraform state and process environments that could contain operational secrets.

Security and DevOps teams should upgrade to Vite 7.3.2 or 8.0.5 or later, remove unnecessary network exposure and investigate previously exposed instances. Potentially disclosed credentials should also be rotated.

Developer tooling may be temporary. The credentials accessible through it often are not.