Skip to content
Today
Sections

Security Independently confirmed3 publishers 3 min read Published

Mass scanners are pulling AWS keys and Terraform state from Vite dev servers exposed with --host

F5 Labs logged more than 800 attacks and about 32,000 raw events against its honeypots in a month, using an April bypass of Vite's server.fs.deny to read .env files, cloud credentials and terraform.tfstate.

The Watch · Security desk

Send a correction

Illustration accompanying Mass scanners are pulling AWS keys and Terraform state from Vite dev servers exposed with --host
Generated illustration

What happened

  • F5 Labs disclosed a mass-scanning campaign against internet-exposed Vite development servers built to steal AWS and Azure credentials and configurations along with infrastructure state files.
  • The harvesting activity was observed in August 2026 and uses an exploit for CVE-2026-39364, a Vite flaw with a CVSS score of 8.2.
  • The bypass affects Vite 7.1.0 through 7.3.2 and the 8.x branch before 8.0.5, and it was disclosed on April 7.

Why it matters

  • Who's exposed exposure Whatever the dev server process can read is reachable, so a laptop or CI container started with --host puts production AWS credentials and a Terraform state map of the estate one GET request away.
  • What it costs cost The version bump is the cheap part. Anyone who exposed an unpatched server pays in rotation: cloud keys, database passwords and Terraform variables, without knowing which files were actually read.
  • What it limits constraint Scoping from logs is degraded, because the attackers set X-Forwarded-For and X-Real-IP themselves and any IP allowlist keyed on those headers passed the traffic.
  • What it sets up precedent The same addresses fired 2024 and 2025 Vite access-control CVEs, so the next Vite file-read flaw should be expected in live scan traffic within months of its advisory.

The request is an ordinary HTTP GET. It goes to the /@fs/ endpoint, names a file path, and appends a bypass parameter. The server processes it, the server.fs.deny check does not hold, and the file comes back as plaintext in the response body [5]. Vite described the failure in its April advisory: "On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended" [4].

Three conditions have to hold for an app to be affected. The dev server has to be exposed to the network with --host or the server.host option. The file has to sit in a directory allowed by server.fs.allow. And it has to be denied by a pattern in server.fs.deny [17]. Vite binds to localhost by default, and F5 said developers undo that by passing --host, setting server.host, or misconfiguring Docker container port mappings [8].

The target list is specific. Wordlists covered .env, .env.production and .env.local, AWS credential files across several possible home directories, AWS config files and credential backups, Azure credentials and access tokens, Terraform state and variable files, and serverless configuration and state [16]. The same requests reached for /etc/passwd, /proc/self/environ, /proc/1/environ and /proc/self/cwd/.env [9]. On that last path, F5 said: "Probing /proc/self/cwd/.env demonstrates an understanding of the deployment stack, reading the active .env file relative to the running process without needing to guess the absolute web application path" [18].

F5's honeypot sensors recorded more than 800 attacks and roughly 32,000 raw events over a month [11]. That works out to about 40 requests per attack and roughly 27 attacks a day [24][25]. Each targeted host was walked through a long list of paths.

The evasion is aimed at the log pipeline as much as the filter. Requests carried forged User-Agent headers impersonating Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot and Amazonbot [19]. They also injected X-Forwarded-For and X-Real-IP values such as 34.94.237[.]62 and 104.28.219[.]193 to get past IP-based access lists and complicate log analysis [20]. F5 also saw traversal and encoding variants, including double-encoded sequences, apparently to survive reverse proxy or WAF normalisation [21]. Its guidance includes not trusting crawler User-Agent strings [13].

Disclosure was April 7 [7]. The harvesting ran in August 2026 [2], about four months later [23]. The most active addresses also used CVE-2025-30208, CVE-2025-31125, which has been flagged as actively exploited, and CVE-2024-45811, all Vite access-control flaws [12]. Traffic came from Google Cloud Platform ranges in 34.x and 35.x [10], with 34.14.15[.]105, 34.16.200[.]129 and 34.11.196[.]206 named as the top sources to blocklist [22].

The two published accounts of F5's data differ on geography: The Hacker News lists the United States, Belgium, the Netherlands, Singapore and Taiwan as the main origins [10], while BleepingComputer lists the first three [15].

Fixes are version bumps and port hygiene. Affected builds are Vite 7.1.0 through 7.3.2 and the 8.x branch before 8.0.5 [6], and F5 recommends updating, blocking access to port 5173, and blocking suspicious /@fs/ requests [13]. Where an unpatched server was publicly exposed, F5 recommends rotating every secret within reach of it [14].

What to watch

  • Whether F5 publishes post-August volumes showing the scanning continuing or moving to newer Vite branches.
  • Whether CVE-2026-39364 gets flagged as actively exploited the way CVE-2025-31125 was.
  • Whether any cloud intrusion is traced back to credentials read from an exposed Vite dev server.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence62
Adoption45
Hype gap+20
Incentives55
Confidence66

Perspective Coverage

3 publishers
Builder
Builder 42%
Operator
Operator 51%
Investor
Investor 7%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    F5 Labs disclosed a mass-scanning campaign against internet-exposed Vite development servers designed to steal cloud credentials and configurations from AWS and Microsoft Azure instances, plus infrastructure state files.

    Reported Supported Source: F5 Labs, via The Hacker NewsView cited source
  2. [2]

    The credential harvesting activity was observed in August 2026 and leverages an exploit for CVE-2026-39364, which carries a CVSS score of 8.2.

    Reported SupportedView cited source
  3. [3]

    CVE-2026-39364 lets an unauthenticated attacker bypass security restrictions via query parameter manipulation and leak sensitive data, including files specified by server.fs.deny.

    Reported SupportedView cited source
  4. [4]

    "On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended"

    Reported Supported Source: Vite advisory, April 2026View cited source
  5. [5]

    Attackers issue an HTTP GET to the /@fs/ endpoint referencing a sensitive file path with bypass query parameters appended, which undermines the server.fs.deny check and returns the file contents in plaintext in the HTTP response body.

    Reported SupportedView cited source
  6. [6]

    CVE-2026-39364 allows bypassing file read and access controls in Vite versions 7.1.0 through 7.3.2 and in the 8.x branch before 8.0.5.

    Reported SupportedView cited source
  7. [7]

    The flaw was disclosed on April 7.

    Reported SupportedView cited source
  8. [8]

    F5 Labs said Vite binds to localhost under default configurations, and that the development server becomes directly reachable over the local network or public internet when developers pass the --host flag, set server.host, or misconfigure Docker container port mappings.

    Reported SupportedView cited source
  9. [9]

    F5 observed requests extracting environment configurations, AWS credentials, AWS configurations and backups, infrastructure state files such as terraform.tfstate and serverless.yml, Azure profiles, and system details including /etc/passwd, /proc/self/environ, /proc/1/environ and /proc/self/cwd/.env.

    Reported SupportedView cited source
  10. [10]

    A significant share of the activity originated from the United States, Belgium, the Netherlands, Singapore and Taiwan, with attackers using Google Cloud Platform ranges in 34.x and 35.x.

    Reported SupportedView cited source
  11. [11]

    F5 detected the attacks through its honeypot sensors, observing more than 800 attacks and approximately 32,000 raw events over a month.

    Reported SupportedView cited source
  12. [12]

    The most active IP addresses also leveraged other Vite access control flaws: CVE-2025-30208, CVE-2025-31125 (flagged as actively exploited) and CVE-2024-45811.

    Reported SupportedView cited source
  13. [13]

    F5 recommends updating Vite servers to the latest version, blocking access through port 5173, blocking suspicious /@fs/ requests, and not trusting crawler User-Agent strings.

    Reported SupportedView cited source
  14. [14]

    If unpatched Vite servers were publicly exposed, it is recommended to rotate all secrets in reach of the vulnerable system.

    Reported SupportedView cited source
  15. [15]

    BleepingComputer reports most of the observed malicious activity originated from the United States, Belgium and the Netherlands, with attackers using Google Cloud IP ranges for evasion.

    Reported SupportedView cited source
  16. [16]

    After reaching a system, the scanning used extensive wordlists covering .env, .env.production, .env.local and other environment files, AWS credential files from several possible home directories, AWS configuration files and credential backups, Azure credentials and access tokens, Terraform state and variable files, and serverless configuration and state.

    Reported SupportedView cited source
  17. [17]

    Exploitation requires three conditions: the Vite dev server is explicitly exposed to the network via --host or server.host; the sensitive file exists in a directory allowed by server.fs.allow; and the file is denied by a pattern matching it in server.fs.deny.

    Reported SupportedView cited source
  18. [18]

    "Probing /proc/self/cwd/.env demonstrates an understanding of the deployment stack, reading the active .env file relative to the running process without needing to guess the absolute web application path"

    Reported Supported Source: F5View cited source
  19. [19]

    The requests used bogus User-Agent headers impersonating major web crawlers and AI bots, including Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot and Amazonbot.

    Reported SupportedView cited source
  20. [20]

    The requests injected forged X-Forwarded-For and X-Real-IP values, for example 34.94.237.62 and 104.28.219.193, to get around IP-based access lists and complicate log analysis.

    Reported SupportedView cited source
  21. [21]

    F5 notes the operation also tried traversal and encoding variants, including double-encoded traversal sequences, apparently to get past reverse proxies or WAF normalization.

    Reported SupportedView cited source
  22. [22]

    The top sources of the malicious attempts are 34.14.15.105, 34.16.200.129 and 34.11.196.206, which should be blocklisted.

    Reported SupportedView cited source
  23. [23]

    About four months separate the April 7 disclosure from the August 2026 harvesting activity.

    Derived Supported
  24. [24]

    The honeypot data works out to about 40 raw events per recorded attack.

    Derived Supported
  25. [25]

    More than 800 attacks over a month is roughly 27 attacks a day.

    Derived Supported

Sources

3 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · September 14, 2026

    Hackers target exposed Vite dev servers to steal AWS, Azure secrets
  2. scworld.com

    1 article · September 15, 2026

    Mass scanning campaign targets Vite development servers for cloud credentials
  3. thehackernews.com

    1 article · September 15, 2026

    Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers

Topics and entities

Topics

Entities