Vite CVE-2026-39364: Exploring Cloud Secrets from Exposed Development Servers

#

1. Basic Information

#

2. Executive Summary

In August 2026, F5 observed approximately 32,000 events targeting .env files and cloud credentials on public Vite development servers. The activity included probes for CVE-2026-39364 and older Vite vulnerabilities. The event count does not establish how many systems were successfully compromised.

#

3. Attack Flow

1. Scanning Public Vite Servers and Conditions for CVE-2026-39364

2. Attackers scan for Vite development servers reachable via ports such as 5173/TCP.

3. F5 has observed requests to endpoints such as /@fs/ . For CVE-2026-39364, specific requests with queries may allow retrieval of files that should be blocked byserver.fs.deny .

4. The sensitive files targeted by this CVE must be within the allowed range of server.fs.allow and match the blocking patterns ofserver.fs.deny . Retrieval does not succeed for all scanned paths.

5. Inference: If the response contains valid cloud credentials, attackers may attempt subsequent access using those permissions.

#

4. Attacker Position and Execution Location

• External attackers who can send HTTP requests to exposed Vite development servers. No authentication or user interaction is required.

#

5. Visibility for Victims and Administrators

Victims

• No user interaction is required, and on-screen warnings may not appear.

Administrators

• Reverse proxy and Vite logs may retain requests containing /@fs/ ,raw /import queries, and abnormal response sizes.

#

6. Success and Failure Conditions

Success Conditions

• The affected version is 7.1.0 or later and less than 7.3.2, or 8.0.0 or later and less than 8.0.5, and the development server is reachable by the attacker.
• The target sensitive file is within the allowed range of server.fs.allow , matches the blocking pattern ofserver.fs.deny , and is readable by the Vite process.

Failure Conditions and Risk Mitigation

• Update 7.x versions to 7.3.2 or later, and 8.x versions to 8.0.5 or later.
• Limit development servers to localhost or necessary networks, and block unauthorized external connections to actual listening ports, including 5173/TCP. Changing ports alone is not a sufficient countermeasure.

#

7. Impact of Successful Exploitation

• Files meeting the vulnerability conditions may be read by bypassing the server.fs.deny restrictions.
• Inference: The exposure of cloud credentials or state files may lead to environment takeover.

#

8. Observable Logs

Inference: Depending on logging configurations, the following records can be used for internal investigations:

Email

• Because this issue involves HTTP requests to Vite, email logs are not a source for confirming initial intrusion.

Proxy, SWG, and DNS

• Inference: Check reverse proxy access logs for request paths, queries, sources, response codes, and response sizes. If exposed directly, records will not appear in proxy logs.

Endpoint and EDR

• Inference: Check Vite process startup arguments, listening addresses, configuration files, and file reads if auditing is enabled. Child process creation is not required for reads via HTTP.

Authentication and IdP

• Inference: Identify the source, time, and principal based on identifiers of credentials suspected of being leaked. Differentiate between normal credential usage and unauthorized access.

SaaS and Cloud

• Inference: Check AWS, Azure, and other audit logs for API operations, permission changes, and data access using the target credentials. Requests to Vite alone do not confirm cloud compromise.

Network

• Inference: Verify connections to actual listening ports using network traffic records. Encrypted TLS traffic prevents identifying request contents or leaked files from flow information alone.

#

9. Determining Attack Success

Scope Confirmed via Public Information

Attack attempts observed (success unconfirmed) : Public information: In August 2026 honeynets, F5 observed 807 attacks (aggregated by session) and approximately 32,000 events targeting multiple Vite vulnerabilities. The number of successful file retrievals at general organizations has not been published.

Internal Judgment Criteria

Information theft or session compromise confirmed : Criteria: Unauthorized access is proven by evidence such as target file contents appearing in responses to attackers. Subsequent credential use alone does not prove that the credentials were obtained through Vite. Correlate credential identifiers, source activity, and timing, and determine whether the use was authorized.

#

10. Investigation Playbook

Inference: The following steps outline an internal investigation procedure based on public information:

Investigation Starting Point

• Start with external exposure of vulnerable Vite instances, or suspicious requests for sensitive files or /@fs/ .

Initial Verification

• Check Vite versions, listening configurations, container exposed ports, reverse proxy settings, and the duration of external exposure.
• Cross-reference server.fs.allow andserver.fs.deny configurations with sensitive file locations, and preserve request and response records.

Endpoint and Server

• Determine if requested files exist and were readable under the specific Vite configuration. Do not assume successful retrieval of sensitive information based solely on 200 responses or large response sizes.

Authentication and Cloud

• Identify credentials that may have been exposed, and review their permissions, usage sources, and API operations. Do not include credential values in investigation tickets.

Subsequent Activity

• Track new authentications, permission additions, data access, or CI/CD operations using the target credentials from unfamiliar sources.

Containment

• Stop unnecessary external exposure and update to patched versions. Revoke and reissue potentially exposed credentials using issuer procedures, and update dependent services.

Judgment Categories

• Distinguish between scan requests, file content returns, sensitive information acquisition, and authentication or subsequent actions using stolen credentials.

#

11. Defense and Detection Ideas

Inference: The following are suggested detection and mitigation ideas based on public data:

Single Event

• Target requests for sensitive files or /@fs/ combined with queries containingraw orimport . Differentiation from legitimate development access is required.

Time-Series Correlation

• Correlate consecutive sensitive file requests from the same connection source, response contents, and unauthorized cloud operations using those credentials.

Threat Hunting

• Review logs of previously exposed development servers for query transformations or encoded paths. Do not narrow investigations solely by default ports and User-Agent values.

Log Shortages and Limitations

• If queries or response contents are not saved, determining successful leakage from requests alone may be difficult. Restrict access to response records containing sensitive values.

Priority Countermeasures

• Prioritize updating to patched versions and reducing public exposure, while revoking potentially leaked secrets and retroactively checking cloud operations.

#

12. Facts, Inference, and Hypothesis

Facts

• CVE-2026-39364 is a file-read vulnerability in Vite development servers that bypasses server.fs.deny via query parameters. The vendor rates it 8.2 on CVSS v4.0 and assigns CWE-180 and CWE-284. Distinguish this rating source from F5's article rating of CVSS 7.5 and CWE-200.
• Affected versions are 7.1.0 up to 7.3.2 (exclusive) and 8.0.0 up to 8.0.5 (exclusive), with fixes in 7.3.2 and 8.0.5. Success conditions require the target file to be within server.fs.allow and matchserver.fs.deny patterns.
• By default, Vite listens on localhost. External reachability is determined by configurations such as --host orserver.host , container port forwarding, and network controls.
• F5 observed scans using /@fs/ and query obfuscation to request.env , AWS and Azure credentials, Terraform state files,/proc/self/environ ,/etc/passwd , and others. Targets include scans for CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811 in addition to CVE-2026-39364.
• In the August 2026 F5 honeynet, 807 attacks aggregated by session and approximately 32,000 raw events were observed.
• Requests used User-Agent strings impersonating Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot. They also contained forged X-Forwarded-For and X-Real-IP header values.

Inference

• Successful reading of sensitive information may lead to lateral movement into cloud environments or CI/CD pipelines using valid credentials.
• Treating requests as benign solely on the basis of their User-Agent strings can allow malicious traffic to evade detection.

Hypothesis

No additional hypotheses. Unverified items are listed in "Unknowns and Additional Investigation".

#

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (Confidence: High): Sends unauthenticated requests to public Vite development servers.

• T1552.001 Unsecured Credentials: Credentials In Files (Confidence: High): Explicitly scans for .env or cloud credential files.

• T1036 Masquerading (Confidence: High): Impersonates search and AI crawler User-Agents.

#

14. Unknowns and Additional Investigation

• The number of organizations where sensitive information reads actually succeeded in real environments.
• The number of subsequent cloud compromises resulting from acquired credentials.

#

15. Impact on SOCs and Organizations

Audit environments with temporarily exposed development Vite instances or container test environments, and retroactively check requests to actual listening ports and sensitive files. Verify exposure scopes and file placements, and judge request observations, file content returns, and cloud credential misuse separately.

#

16. Summary by Role

• SOC: Review query-based requests for sensitive files or /@fs/ , and correlate response contents with credential usage. Do not judge requests as normal based solely on crawler-claiming User-Agents.
• Administrators: Update 7.x versions to 7.3.2 or later and 8.x versions to 8.0.5 or later, and stop unnecessary external exposure of development servers. Revoke and reissue credentials if exposure is suspected.
• Users: No user action is required.

source & further reading

dev.to — original article Puzzle Solution Revealed - Transformer: Need for Position Embedding I'm Building an AI Assistant in C#. I Don't Want to Rewrite Every Tool. master-of: Gave my 20+ Claude Code skills a bouncer at the door