Vite CVE-2026-39364: mass scanning of exposed dev servers for AWS/Azure secrets

Vulnerability

Published 2026-09-14

Verified 2026-09-19

Vite CVE-2026-39364: mass scanning of exposed dev servers for AWS/Azure secrets

F5 Labs Sensor Intel (11 September 2026; BleepingComputer 14 September) reports a sustained August 2026 mass-scanning campaign against internet-exposed Vite development servers harvesting cloud credentials and IaC state. Activity is anchored on CVE-2026-39364, an unauthenticated server.fs.deny / file-read bypass via query parameters such as ?raw, ?import&raw, or ?import&url&inline on /@fs/ requests (GitHub advisory GHSA-v2wj-q39q-566r, published 6–7 April 2026). GitHub rates CVSS 4.0 8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N); F5 also cites CVSS 7.5 High for the same CVE. Affected: Vite 7.1.0–7.3.1 and 8.0.0–8.0.4 (also vite-plus ≤0.1.15). Patched: 7.3.2, 8.0.5, and current patched lines on older branches per vendor. F5 honeypots saw ~807 session-grouped attacks and ~32,000 raw events in August, wordlisting .env files, AWS/Azure credential paths, Terraform/serverless state, and /proc environ; scanners also reused older Vite bypasses CVE-2025-30208, CVE-2025-31125 (CISA KEV), and CVE-2024-45811. Exposure usually comes from --host / server.host or Docker port maps (often 5173). Mitigations: upgrade; do not expose dev ports; block /@fs/; rotate secrets if an unpatched Vite was reachable. Primary: F5 Labs; vendor: GitHub advisory; secondary: BleepingComputer.

Product

Vite (npm frontend tooling / development server)

Versions

Affected 7.1.0–7.3.1 and 8.0.0–8.0.4 (vite-plus ≤0.1.15); requires network-exposed dev server (--host/server.host)

CVSS

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

AVAttack Vector: Network
ACAttack Complexity: Low
ATAttack Requirements: Present
PRPrivileges Required: None
UIUser Interaction: None
VCVulnerable System Confidentiality: High
VIVulnerable System Integrity: None
VAVulnerable System Availability: None
SCSubsequent System Confidentiality: None
SISubsequent System Integrity: None
SASubsequent System Availability: None

(CVSS 4.0, GitHub); F5 also cites 7.5 High

Exploited in Australia?

unknown

Patch to

Upgrade to Vite 7.3.2 / 8.0.5 (or latest patched on your branch); remove public exposure of port 5173 /@fs/; rotate AWS/Azure/.env/Terraform secrets if exposed

Primary: F5 Labs — Cloud Takeover: exposed Vite (CVE-2026-39364) (11 Sep 2026) · Vendor: GitHub — Vite GHSA-v2wj-q39q-566r / CVE-2026-39364 · CVE: CVE-2026-39364, CVE-2025-30208, CVE-2025-31125, CVE-2024-45811 · BleepingComputer (14 Sep 2026)

tech cloud