# Exposed Vite servers are being probed for AWS and Azure credentials

DevFeed: [Exposed Vite servers are being probed for AWS and Azure credentials](<https://devfeed.tech/articles/exposed-vite-servers-are-being-probed-for-aws-and-azure-credentials-47835.md>)

Original publisher: [Read original article](<https://www.infoworld.com/article/4222246/exposed-vite-servers-are-being-probed-for-aws-and-azure-credentials.html>)

Author: Shweta Sharma

Published: 2026-09-15T14:22:40Z

Content type: news

Language: en

Sources: [InfoWorld](<https://devfeed.tech/sources/infoworld.md>)

Topics: [Vite](<https://devfeed.tech/topics/vite.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Security](<https://devfeed.tech/topics/security.md>), [sensitive data](<https://devfeed.tech/topics/sensitive-data.md>), [Build tool](<https://devfeed.tech/topics/build-tool.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Azure](<https://devfeed.tech/topics/azure.md>), [Infrastructure as code](<https://devfeed.tech/topics/infrastructure-as-code.md>), [container](<https://devfeed.tech/topics/container.md>), [Vue.js](<https://devfeed.tech/topics/vue.md>), [User Interfaces](<https://devfeed.tech/topics/user-interfaces.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [azure](<https://devfeed.tech/tags/azure.md>), [build-tool](<https://devfeed.tech/tags/build-tool.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [code-security-development-tools-security-software-development](<https://devfeed.tech/tags/code-security-development-tools-security-software-development.md>), [container](<https://devfeed.tech/tags/container.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [development-tools](<https://devfeed.tech/tags/development-tools.md>), [infrastructure-as-code](<https://devfeed.tech/tags/infrastructure-as-code.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [security](<https://devfeed.tech/tags/security.md>), [software-development](<https://devfeed.tech/tags/software-development.md>), [vite](<https://devfeed.tech/tags/vite.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Attackers are scanning exposed Vite development servers for cloud credentials, environment files, infrastructure configuration, and other sensitive data. The activity exploits CVE-2026-39364, a file-access restriction bypass affecting specified Vite versions.

## Source excerpt

Attackers have opened a new front in their war on software developers: Vite servers, which they are probing for sensitive data including cloud credentials, infrastructure configuration and environment files. Vite was created as a build tool for Vue, a JavaScript framework for building user interfaces and web applications, but has now become a widely used development server and build tool across the JavaScript ecosystem. F5 Labs reported that attackers sent more than 32,000 attempts to scan exposed Vite servers on its honeypot network, grouped into 807 attacks (or sessions), during August, a sharp increase from just 1,732 attempts over the previous three months. "Rather than target a single file, the scanning fleet systematically cycled through extensive wordlists of environment files, AWS keys, Azure tokens, and Infrastructure-as-Code state files," F5 threat researcher, Adam Metcalfe-Pearce, wrote in a blog post on F5's blog. F5 noted that Vite normally binds to localhost, but developers can expose it through the "-host" option, server configuration, container port mappings or other deployment mistakes. Scans targeted a file-access bypass The activity targeted a recently disclosed vulnerability that allows unauthenticated attackers to bypass Vite's file-access restriction and retrieve files from the host system. Tracked as CVE-2026-39364, the flaw allows attackers to bypass the "server.fs.deny" deny-list protection used to prevent access to sensitive files. "When specific parameters such as ?raw, ?import&raw, or ?import&url&inline are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response," Metcalfe-Pearce wrote. Some requests also used double-encoded path traversal, which F5 said indicated an attempt to evade security controls such as reverse proxies and web application firewalls (WAFs). Assigned a severity rating of CVSS 8.2 ,the flaw affects Vite 7.1.0 through versions before 7.3.2 and Vite 8 ve