Mass Scanning Targets Exposed Vite Servers to Steal AWS Keys and Azure Tokens

In August 2026, automated threat activity targeting exposed Vite development servers increased significantly. Attackers aimed to extract cloud credentials, environment files, and infrastructure state data by exploiting a critical file-read vulnerability known as CVE-2026-39364.

Honeynet telemetry recorded 807 session-grouped attacks and approximately 32,000 raw events during the monthly analysis period.

This campaign shows how quickly attackers can exploit newly disclosed vulnerabilities in developer tools, especially when they provide unauthenticated access to sensitive information that could enable cloud account takeovers.

Exploitation of the Vite File-Read Flaw

CVE-2026-39364 is an unauthenticated access-control bypass in the Vite development server, rated 7.5 on the CVSS scale. This vulnerability affects Vite versions 7.1.0 through 7.3.2 and 8.0.5.

The flaw permits remote attackers to bypass the server.fs.deny restrictions set by Vite, which are designed to prevent sensitive host files, such as .env files, certificates, and application source code, from being served through the development server.

Vite includes an internal @fs route to support local development workflows. Attackers can manipulate query parameters like ?raw, ?import&raw, or ?import&url&inline to circumvent the configured deny list. A successful request will return the targeted file in plaintext over HTTP.

According to F5 Labs, the attack activity also included attempts to exploit older Vite vulnerabilities, including CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811. These vulnerabilities also involve query-string-based bypasses that affect file-access controls.

The scanners did not restrict their targeting to generic .env files. Instead, they employed extensive wordlists to locate cloud credentials and deployment artifacts across common Linux, container, and web application paths. Frequently targeted resources included:

• Environment files such as .env, .env.production, .env.local, and .env.staging
• AWS credential files, including /root/.aws/credentials, /home/ubuntu/.aws/credentials, and /app/.aws/credentials
• Azure token and credential stores, including .azure/credentials and .azure/accessTokens.json
• Terraform and serverless deployment data, such as terraform.tfstate, terraform.tfvars, serverless.yml, and .serverless/serverless-state.json
• System resources including /etc/passwd, /proc/self/environ, and /proc/1/environ

One notable target was /proc/self/cwd/.env, which lets attackers expose the active application directory’s environment file without knowing the absolute deployment path.

Such files may contain sensitive information, including database passwords, API keys, authentication secrets, and cloud access keys, potentially enabling lateral movement or complete compromise of cloud environments.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.