Vite CVE-2026-39364: Exploring Cloud Secrets from Exposed Development Servers

F5 researchers observed roughly 32,000 events in August 2026 targeting .env files and cloud credentials on publicly exposed Vite development servers, including probes for CVE-2026-39364 and older Vite flaws. The vulnerability, affecting Vite 7.1.0 through 7.3.2 and 8.0.0 through 8.0.5, can let unauthenticated attackers bypass server.fs.deny restrictions and read sensitive files within the allowed filesystem range. F5 recommends upgrading to 7.3.2 or 8.0.5 and restricting development servers to localhost or trusted networks, noting that changing ports alone is not sufficient.

1. Basic Information 2. Executive Summary In August 2026, F5 observed approximately 32,000 events targeting .env files and cloud credentials on public Vite development servers. The activity included probes for CVE-2026-39364 and older Vite vulnerabilities. The event count does not establish how many systems were successfully compromised. 3. Attack Flow 1. Scanning Public Vite Servers and Conditions for CVE-2026-39364 1. Attackers scan for Vite development servers reachable via ports such as 5173/TCP. 2. F5 has observed requests to endpoints such as /@fs/ . For CVE-2026-39364, specific requests with queries may allow retrieval of files that should be blocked by server.fs.deny . 3. The sensitive files targeted by this CVE must be within the allowed range of server.fs.allow and match the blocking patterns of server.fs.deny . Retrieval does not succeed for all scanned paths. 4. Inference: If the response contains valid cloud credentials, attackers may attempt subsequent access using those permissions. 4. Attacker Position and Execution Location - External attackers who can send HTTP requests to exposed Vite development servers. No authentication or user interaction is required. 5. Visibility for Victims and Administrators Victims - No user interaction is required, and on-screen warnings may not appear. Administrators - Reverse proxy and Vite logs may retain requests containing /@fs/ , raw / import queries, and abnormal response sizes. 6. Success and Failure Conditions Success Conditions - The affected version is 7.1.0 or later and less than 7.3.2, or 8.0.0 or later and less than 8.0.5, and the development server is reachable by the attacker. - The target sensitive file is within the allowed range of server.fs.allow , matches the blocking pattern of server.fs.deny , and is readable by the Vite process. Failure Conditions and Risk Mitigation - Update 7.x versions to 7.3.2 or later, and 8.x versions to 8.0.5 or later. - Limit development servers to localhost or necessary networks, and block unauthorized external connections to actual listening ports, including 5173/TCP. Changing ports alone is not a sufficient countermeasure. 7. Impact of Successful Exploitation - Files meeting the vulnerability conditions may be read by bypassing the server.fs.deny restrictions. - Inference: The exposure of cloud credentials or state files may lead to environment takeover. 8. Observable Logs Inference: Depending on logging configurations, the following records can be used for internal investigations: Email - Because this issue involves HTTP requests to Vite, email logs are not a source for confirming initial intrusion. Proxy, SWG, and DNS - Inference: Check reverse proxy access logs for request paths, queries, sources, response codes, and response sizes. If exposed directly, records will not appear in proxy logs. Endpoint and EDR - Inference: Check Vite process startup arguments, listening addresses, configuration files, and file reads if auditing is enabled. Child process creation is not required for reads via HTTP. Authentication and IdP - Inference: Identify the source, time, and principal based on identifiers of credentials suspected of being leaked. Differentiate between normal credential usage and unauthorized access. SaaS and Cloud - Inference: Check AWS, Azure, and other audit logs for API operations, permission changes, and data access using the target credentials. Requests to Vite alone do not confirm cloud compromise. Network - Inference: Verify connections to actual listening ports using network traffic records. Encrypted TLS traffic prevents identifying request contents or leaked files from flow information alone. 9. Determining Attack Success Scope Confirmed via Public Information - Attack attempts observed success unconfirmed : Public information: In August 2026 honeynets, F5 observed 807 attacks aggregated by session and approximately 32,000 events targeting multiple Vite vulnerabilities. The number of successful file retrievals at general organizations has not been published. Internal Judgment Criteria - Information theft or session compromise confirmed : Criteria: Unauthorized access is proven by evidence such as target file contents appearing in responses to attackers. Subsequent credential use alone does not prove that the credentials were obtained through Vite. Correlate credential identifiers, source activity, and timing, and determine whether the use was authorized. 10. Investigation Playbook Inference: The following steps outline an internal investigation procedure based on public information: Investigation Starting Point - Start with external exposure of vulnerable Vite instances, or suspicious requests for sensitive files or /@fs/ . Initial Verification - Check Vite versions, listening configurations, container exposed ports, reverse proxy settings, and the duration of external exposure. - Cross-reference server.fs.allow and server.fs.deny configurations with sensitive file locations, and preserve request and response records. Endpoint and Server - Determine if requested files exist and were readable under the specific Vite configuration. Do not assume successful retrieval of sensitive information based solely on 200 responses or large response sizes. Authentication and Cloud - Identify credentials that may have been exposed, and review their permissions, usage sources, and API operations. Do not include credential values in investigation tickets. Subsequent Activity - Track new authentications, permission additions, data access, or CI/CD operations using the target credentials from unfamiliar sources. Containment - Stop unnecessary external exposure and update to patched versions. Revoke and reissue potentially exposed credentials using issuer procedures, and update dependent services. Judgment Categories - Distinguish between scan requests, file content returns, sensitive information acquisition, and authentication or subsequent actions using stolen credentials. 11. Defense and Detection Ideas Inference: The following are suggested detection and mitigation ideas based on public data: Single Event - Target requests for sensitive files or /@fs/ combined with queries containing raw or import . Differentiation from legitimate development access is required. Time-Series Correlation - Correlate consecutive sensitive file requests from the same connection source, response contents, and unauthorized cloud operations using those credentials. Threat Hunting - Review logs of previously exposed development servers for query transformations or encoded paths. Do not narrow investigations solely by default ports and User-Agent values. Log Shortages and Limitations - If queries or response contents are not saved, determining successful leakage from requests alone may be difficult. Restrict access to response records containing sensitive values. Priority Countermeasures - Prioritize updating to patched versions and reducing public exposure, while revoking potentially leaked secrets and retroactively checking cloud operations. 12. Facts, Inference, and Hypothesis Facts - CVE-2026-39364 is a file-read vulnerability in Vite development servers that bypasses server.fs.deny via query parameters. The vendor rates it 8.2 on CVSS v4.0 and assigns CWE-180 and CWE-284. Distinguish this rating source from F5's article rating of CVSS 7.5 and CWE-200. - Affected versions are 7.1.0 up to 7.3.2 exclusive and 8.0.0 up to 8.0.5 exclusive , with fixes in 7.3.2 and 8.0.5. Success conditions require the target file to be within server.fs.allow and match server.fs.deny patterns. - By default, Vite listens on localhost. External reachability is determined by configurations such as --host or server.host , container port forwarding, and network controls. - F5 observed scans using /@fs/ and query obfuscation to request .env , AWS and Azure credentials, Terraform state files, /proc/self/environ , /etc/passwd , and others. Targets include scans for CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811 in addition to CVE-2026-39364. - In the August 2026 F5 honeynet, 807 attacks aggregated by session and approximately 32,000 raw events were observed. - Requests used User-Agent strings impersonating Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot. They also contained forged X-Forwarded-For and X-Real-IP header values. Inference - Successful reading of sensitive information may lead to lateral movement into cloud environments or CI/CD pipelines using valid credentials. - Treating requests as benign solely on the basis of their User-Agent strings can allow malicious traffic to evade detection. Hypothesis No additional hypotheses. Unverified items are listed in "Unknowns and Additional Investigation". 13. MITRE ATT&CK Mapping - T1190 Exploit Public-Facing Application Confidence: High : Sends unauthenticated requests to public Vite development servers. - T1552.001 Unsecured Credentials: Credentials In Files Confidence: High : Explicitly scans for .env or cloud credential files. - T1036 Masquerading Confidence: High : Impersonates search and AI crawler User-Agents. 14. Unknowns and Additional Investigation - The number of organizations where sensitive information reads actually succeeded in real environments. - The number of subsequent cloud compromises resulting from acquired credentials. 15. Impact on SOCs and Organizations Audit environments with temporarily exposed development Vite instances or container test environments, and retroactively check requests to actual listening ports and sensitive files. Verify exposure scopes and file placements, and judge request observations, file content returns, and cloud credential misuse separately. 16. Summary by Role - SOC: Review query-based requests for sensitive files or /@fs/ , and correlate response contents with credential usage. Do not judge requests as normal based solely on crawler-claiming User-Agents. - Administrators: Update 7.x versions to 7.3.2 or later and 8.x versions to 8.0.5 or later, and stop unnecessary external exposure of development servers. Revoke and reissue credentials if exposure is suspected. - Users: No user action is required.