Vite dev servers CVE-2026-39364: scanned for cloud keys

Somebody is scanning the internet for your dev server. F5 Labs logged 807 session-grouped attacks and roughly 32,000 raw events in a single month against internet-exposed Vite development servers, using CVE-2026-39364 to read .env files, AWS credentials, Azure profiles, and Terraform state straight off disk. This is not a theoretical supply-chain risk. It's a mass scan with a shopping list.

What actually happened

Per F5 Labs' report, CVE-2026-39364 is a file-disclosure and access-list bypass in the Vite dev server, CVSS 7.5, disclosed April 7, 2026, affecting Vite 7.1.0 up to 7.3.2 and the 8.x branch before 8.0.5.

The exploit is embarrassingly simple. Append a query parameter — ?raw, ?import&raw, ?import&url&inline — to a GET request and the server skips its deny-list filtering and returns the file with an HTTP 200. No authentication. No exploit chain. A query string.

F5's honeynet telemetry for August 2026 recorded the 807 attacks against a baseline of 1,732 Vite-related events across the entire prior three months. Traffic originated mostly from the United States (17,297 events), Belgium (4,407), and the Netherlands (4,011), with the most active sources running from Google Cloud IP ranges. The same scanner cluster also probed older Vite access-control bugs — CVE-2025-30208, CVE-2025-31125, CVE-2024-45811 — and a Next.js middleware bypass, which tells you it's a multi-framework probing library, not a Vite specialist.

The targets were consistent: .env variants, AWS credentials across user directories, Azure profiles, Terraform state files, /proc/self/environ, /etc/passwd. That is a list assembled by someone who wants your cloud account, not your website.

Why exposed dev servers matter for your business

The dev server was never supposed to be on the internet. vite dev binds to localhost by default for exactly this reason. It gets exposed by accident: a --host flag added to test on a phone, a Docker container published with 0.0.0.0, a staging box someone spun up for a client demo and never took down, a preview environment on a cloud VM with a public IP. Every one of those is a normal Tuesday decision. None of them feels like opening a door.

A leaked .env is worse than a leaked database. A database dump is a bad day. A .env with live AWS keys is an attacker inside your infrastructure, spinning up compute on your bill, reading S3, and pivoting. And Terraform state is the one nobody thinks about — it contains secrets in plaintext by design, and it maps your entire infrastructure for whoever reads it.

Three controls, in order. Update Vite to 7.3.2 or 8.0.5 and later. Keep dev servers bound to a local interface, and if remote access is genuinely needed, put it behind a tunnel or VPN rather than a public port. Then stop shipping real credentials to dev at all: local development should use scoped, disposable keys, so that a leak is an inconvenience rather than an incident.

Then assume you already leaked. If any Vite server of yours has been reachable from the internet in the last several months, rotation is the only honest response — AWS keys, Azure credentials, anything in a .env that box could see. F5 lists credential rotation among its own recommendations. Rotating keys is a slow afternoon. Not rotating them is a bet that 32,000 scan events all missed you.

Sources: F5 Labs: Cloud Takeover — Mass Scanning for Exposed Vite Endpoints (CVE-2026-39364), BleepingComputer.