Automated scanning campaigns are targeting publicly exposed Vite development servers to extract sensitive cloud credentials and configurations from AWS and Azure environments. Security researchers at F5 have tracked hundreds of attacks exploiting a high-severity file-access vulnerability, putting enterprise infrastructure at risk through misconfigured developer workstations.
The Mechanics Behind CVE-2026-39364
Security analysts at F5 detected a mass-scanning campaign exploiting CVE-2026-39364, a high-severity vulnerability affecting specific versions of the popular frontend build tool. The flaw impacts Vite versions 7.1.0 through 7.3.2, alongside iterations of the 8.x branch prior to 8.0.5.
An unauthenticated attacker can bypass file-access restrictions by appending specially crafted query parameters to HTTP GET requests. Inputs like ?raw, ?import&raw, and ?import&url&inline trick the server into mishandling its internal deny-list filters. Instead of rejecting the payload with a 403 Forbidden status, the vulnerable server returns the protected file via an HTTP 200 response.
The scale of the threat is immense. F5’s honeypot infrastructure recorded more than 800 distinct attacks and roughly 32,000 raw events over a single month. This volume points to broad, indiscriminate automation rather than targeted spear-phishing.
Hunting the .env Ecosystem and Cloud Keys
A file-reading bug might seem less dangerous than direct remote code execution. In modern web development, however, the file system of a local or cloud-hosted build server is a goldmine of secrets. Attackers are systematically hunting for environment configuration files, including .env, .env.production, and .env.local.
Developers routinely drop API keys, database connection strings, encryption material, and signing secrets into these files during rapid prototyping, often forgetting to purge them before deployment. The automated scanners do not rely on a single directory structure.
- Target 1: Local environment files containing unencrypted database passwords and third-party API keys.
- Target 2: AWS credential and configuration directories across various user home paths.
- Target 3: Azure authentication tokens and service principal secrets.
Defending the Build Pipeline
Mitigating this campaign requires immediate operational hygiene across engineering teams. First, organizations running affected software must upgrade their build tooling past the patched thresholds immediately. Second, development servers must never be exposed directly to the public internet. Utilizing secure virtual private networks (VPNs) or zero-trust network access (ZTNA) layers prevents external scanners from probing local ports.
Furthermore, developers should audit environment files to ensure production secrets never reside on local development machines. Utilizing dedicated secret managers rather than plain-text configuration files limits the blast radius when an edge environment is compromised.
