As reported by BleepingComputer, a coordinated mass-scanning campaign is actively exploiting internet-exposed Vite development servers to exfiltrate cloud credentials and configuration files. F5's honeypot sensors captured over 800 attack attempts and 32,000 raw events in a single month, revealing a sophisticated operation that combines CVE-2026-39364 with several previously disclosed Vite flaws to maximize data theft.
Why This Matters
Development servers are often treated as ephemeral and low-priority from a security standpoint, but this campaign demonstrates exactly why that assumption is dangerous. Vite is widely used in modern JavaScript/TypeScript build tooling, and when developers expose the dev server to the internet — intentionally for testing or accidentally through misconfigured Docker port mappings — they create a direct conduit to every secret the application touches. Environment files, AWS credential pairs, Azure tokens, and Terraform state files are all within reach.
The attackers are not opportunistic amateurs. Their wordlists are comprehensive, their traversal techniques include double-encoding to evade WAF normalization, and they are leveraging Google Cloud IP ranges for infrastructure that blends into legitimate traffic. The reuse of older Vite CVEs (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811) alongside the newer CVE-2026-39364 suggests a mature playbook where any unpatched instance is a viable target.
Vulnerability Details
| CVE | Severity | Affected Versions | Patch Available | Active Exploitation |
|---|---|---|---|---|
| CVE-2026-39364 | High | Vite 7.1.0 – 7.3.2; 8.x before 8.0.5 | Yes — update to latest | Yes |
| CVE-2025-30208 | High | Vite < 6.0.12 (relevant versions) | Yes | Yes |
| CVE-2025-31125 | High | Vite (affected range) | Yes | Yes — CISA flagged |
| CVE-2024-45811 | High | Vite (affected range) | Yes | Observed in this campaign |
Who Is at Risk
--host flag or server.host configuration exposing port 5173 to the public internetThe core issue is architectural: development servers should never be reachable from the public internet. Every exposed instance is effectively a credentials API endpoint waiting to be queried.
Shield53 Recommendations
Immediate Actions
- Patch Vite immediately to the latest version (8.0.5+ or 7.3.3+ depending on your branch) — this addresses all four CVEs referenced in the campaign
- Block port 5173 at all perimeter firewalls and security groups; dev servers must not be internet-reachable
- Rotate all secrets that were accessible from any exposed Vite instance:
.envfiles, AWS keys, Azure tokens, Terraform state, and any credentials in home directories. Assume compromise if exposure existed - Blocklist identified IPs: 34.14.15[.]105, 34.16.200[.]129, 34.11.196[.]206
- Review cloud audit logs for unauthorized API calls or IAM activity tied to credentials that may have been exposed
Hardening & Detection
- Restrict Vite to localhost binding (
server.host: 'localhost') unless there is a documented, time-boxed reason to do otherwise - Implement WAF or reverse proxy rules that reject requests containing
?raw,?import&raw,?import&url&inlinequery parameters and/@fs/path prefixes - Deploy deception files (canary tokens) in
.envpaths on dev servers to detect unauthorized access early - Adopt short-lived, scoped cloud credentials for development environments instead of static long-lived access keys — rotating credentials reduces blast radius even when theft occurs
- Scan your external attack surface for any Vite dev server signatures (default headers, port 5173, Vite-specific HTTP response patterns) to catch misconfigurations before attackers do
This campaign reinforces a broader principle: the boundary between development and production security is illusory when credentials cross it. Every dev server that touches real cloud resources inherits production-grade risk. Treat it accordingly.
