Vite Flaw Enables Mass Theft of Cloud Secrets

A coordinated scanning campaign is currently targeting internet-facing development servers to harvest sensitive data. The operation leverages a high-severity flaw in Vite, a tool widely used by developers to build modern web applications. By exploiting this weakness, attackers can bypass security controls designed to hide critical configuration files, effectively turning local development setups into open doors for credential theft.

The vulnerability, tracked as CVE-2026-39364, allows unauthenticated users to access files that should be strictly blocked. According to F5 Labs, which observed the activity in August 2026, the exploit works by manipulating query parameters in HTTP requests. This technique tricks the server into returning plaintext data, including API keys, database passwords, and cloud administrative credentials, in the response body.

Default Settings Protect Most Users

It is important to clarify that this exploit does not affect every installation of Vite. The tool binds to localhost by default, meaning it is only accessible from the same machine where it is running. The risk emerges only when developers explicitly expose the server to a network using specific configuration flags or Docker port mappings. If a service is not intentionally made reachable over the local network or public internet, it remains largely invisible to external scanners.

Bypassing Security Filters Through Tricks

Vite includes a security feature called server.fs.deny, which is intended to prevent access to sensitive files like .env files and certificates. However, the flaw allows attackers to append specific parameters, such as ?raw or ?import&url&inline, to their requests. This manipulation undermines the denial check, causing the server to process the request and return the file contents in plaintext. The catch is that this requires the sensitive file to exist within directories that are explicitly allowed by the server configuration.

Camouflaging Attacks As Regular Traffic

To avoid detection and analysis, the campaign uses deceptive techniques. The malicious requests mimic the user-agent headers of well-known web crawlers and AI bots, such as Googlebot and GPTBot. Additionally, attackers inject forged IP addresses into headers to bypass access lists and obscure their true location. The Hacker News notes that much of this activity originates from cloud service ranges in the United States, Belgium, and other regions, making it difficult to trace back to specific physical locations.