Mass scans hunt exposed Vite dev servers for AWS and Azure keys

Bleeping Computer published details on 14 September 2026 of a mass scanning campaign aimed at Vite development servers that are reachable from the internet. The attackers are not trying to take control of the machines — they are after secrets: AWS credentials, Azure access tokens, configuration files.

One month of observation, more than 800 attacks

The data comes from honeypot sensors run by vendor F5, which recorded more than 800 attacks and roughly 32,000 raw events over a month. Most of the malicious activity observed originated from the United States, Belgium and the Netherlands, with the attackers using Google Cloud address ranges to obscure their origin. Three addresses stand out as the most active and are recommended for blocking: 34.14.15.105, 34.16.200.129 and 34.11.196.206.

These findings rest on a single source — the Bleeping Computer report relaying F5’s analysis — and are not corroborated elsewhere at this stage.

A flaw that serves files in the clear

The campaign exploits CVE-2026-39364, a high-severity vulnerability disclosed on 7 April that allows Vite’s file access controls to be bypassed. Affected versions are 7.1.0 through 7.3.2, along with the 8.x branch before 8.0.5.

The mechanism requires no authentication: appending certain parameters to an HTTP GET request — ?raw, ?import&raw or ?import&url&inline — is enough for the server to stop applying its deny-list filtering and return the requested file in the clear, with a 200 response code. F5 also notes encoding and directory traversal variants, including double-encoded sequences, apparently designed to get past the normalisation performed by reverse proxies and web application firewalls.

The most active addresses also take advantage of other Vite access control flaws: CVE-2025-30208, CVE-2025-31125 — flagged as actively exploited — and CVE-2024-45811.

What the wordlists are looking for

Once file reads are available, the scan works through extensive lists: .env, .env.production, .env.local and other environment files; AWS credential files across several possible home directories; AWS configuration files and credential backups; Azure credentials and access tokens; Terraform state and variable files; serverless configurations and state. To these are added /proc/self/environ, /proc/1/environ, /proc/self/cwd/.env and /etc/passwd.

Vite listens on localhost, unless you tell it otherwise

By default, Vite’s development server listens only on the local machine. F5’s researchers point out that it is developers who expose it, by passing the --host option, by setting server.host, or through a misconfigured Docker port mapping. The problem is not the npm run dev command itself, but the gap between what it is designed to do and where it ends up running.

The recommended measures come down to four steps: update Vite to the latest version, which fixes the exploited flaws; block access to port 5173; block suspicious /@fs/ requests; and place no trust in User-Agent strings that claim to be search engine crawlers. And if an unpatched Vite server has been publicly exposed, rotate every secret within reach of the vulnerable system.

A development server is a convenience tool, built for a machine that only talks to itself. Opened up to the internet, it becomes a service nobody designed it to be — and it answers anyway.