A mass-scanning campaign is sweeping internet-exposed Vite development servers for cloud credentials, F5 Labs reports.
The activity, seen through August, exploits CVE-2026-39364, a high-severity flaw rated 8.2. By appending query parameters such as ?raw, ?import&raw, or ?import&url&inline to a request against the /@fs/ endpoint, an unauthenticated attacker defeats the server.fs.deny restriction and reads files that should be blocked.
Three conditions must line up. The dev server has to be exposed to the network through –host or the server.host setting. The target file must sit in an allowed directory. And it must be denied by a matching pattern. Vite binds to localhost by default, but developers who expose the service, or who misconfigure Docker port mappings, make it reachable.
F5 said it observed requests that pulled environment configurations, AWS credentials, AWS backups, infrastructure state files such as terraform.tfstate and serverless.yml, Azure profiles, and system data from /etc/passwd and /proc files.
To blend in, the attackers used fake User-Agent strings impersonating Googlebot, ClaudeBot, GPTBot, PerplexityBot, and Amazonbot, and injected forged X-Forwarded-For and X-Real-IP headers to slip past IP allowlists. Much of the traffic came from Google Cloud Platform ranges, with sources spread across the US, Belgium, the Netherlands, Singapore, and Taiwan.
The takeaway for developers is blunt: keep development servers off the public internet.
