GoKawiilAttackers exploit Vite server flaw to harvest AWS and Azure credentials
F5's honeypots detected a month-long scanning campaign exploiting CVE-2026-39364, a high-severity flaw in Vite versions 7.1.0-7.3.2 and pre-8.0.5, that lets unauthenticated attackers bypass access controls via crafted query parameters like ?raw or ?import&raw. Over 800 attacks and roughly 32,000 events were recorded, with attackers hunting for environment files, AWS and Azure credentials, Terraform state files, and system files like /etc/passwd. Most activity came from the US, Belgium, and the Netherlands, with some attackers routing through Google Cloud IPs and also exploiting older Vite access-control bugs.
GoKawiil's interpretation of the reporting above, not reported fact.
Development servers are often left exposed with weaker security assumptions than production systems, making them an easy entry point for stealing cloud credentials that grant far broader access. The scale and automation of this campaign shows attackers are systematically weaponizing newly disclosed vulnerabilities within days, targeting the secrets sprawl common in modern cloud-native development workflows.
- CVE-2026-39364 lets attackers bypass Vite's file access restrictions using specially crafted query parameters.
- The campaign specifically targets cloud credentials, Terraform state files, and environment variables to compromise AWS and Azure accounts.
- Attackers combined this new flaw with older Vite vulnerabilities and traversal techniques to evade proxies and WAFs.
Source: bleepingcomputer.com, 2026-09-14
Published there as: “Hackers target exposed Vite dev servers to steal AWS, Azure secrets”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.