“When specific parameters such as ?raw, ?import&raw, or ?import&url&inline are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response,” F5 explains — a behavior that its sensors observed being mass-exploited in the wild.
CVE-2026-39364: Vite versions affected and disclosure date
The campaign leverages CVE-2026-39364, a high-severity vulnerability disclosed on April 7 that permits an unauthenticated attacker to bypass file read and access controls in Vite. Affected builds include Vite versions 7.1.0 through 7.3.2 and the 8.x branch prior to 8.0.5. According to F5’s analysis, the flaw allows manipulation of query parameters in an HTTP GET to retrieve plaintext files that should otherwise be blocked.
F5’s findings: scanning volume, geographic origins, and top IPs
F5 detected the operation using its honeypot sensors, recording more than 800 attacks and roughly 32,000 raw events over a month. Most observed malicious activity traced back to IP space in the United States, Belgium, and the Netherlands, with attackers making use of Google Cloud IP ranges to impede attribution and evade simple network-level filters. F5 identified three top source addresses — 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206 — and recommends they be blocklisted.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageHow attackers retrieved secrets: query-parameter bypass and targeted files
The exploitation pattern is specific: appending parameters such as ?raw, ?import&raw, or ?import&url&inline to requests causes the server to ignore deny-lists and respond with HTTP 200 along with file contents. Once inside, scanners focused on high-value targets. F5 observed attackers using extensive wordlists aimed at procurement of cloud credentials and configuration data, including:
- .env, .env.production, .env.local and other environment files
- AWS credential files from several potential home directories, and AWS configuration files and credential backups
- Azure credentials and access tokens
- Terraform state and variable files, and serverless configuration/state
- /proc/self/environ, /proc/1/environ, and /proc/self/cwd/.env
- /etc/passwd
F5’s pattern shows the attackers prioritized cloud secrets — AWS and Azure credentials — and supporting infrastructure-as-code artifacts that can widen access or persist control.
Techniques to evade protections: traversal, encoding, and other Vite flaws
Alongside the query-parameter bypass, the operation tried traversal and encoding variants, including double-encoded traversal sequences, apparently to defeat reverse proxies or web application firewall (WAF) normalization. The most active IPs did not restrict themselves to CVE-2026-39364; they also leveraged other Vite access-control issues: CVE-2025-30208, CVE-2025-31125 (which F5 flagged as actively exploited), and CVE-2024-45811.
What this means for developers, cloud operators, and incident responders
- Developers: Many Vite servers bind to localhost by default, but F5 notes developers commonly expose them by passing the --host flag, setting server.host, or via misconfigured Docker port mappings. Those who run local development servers reachable from the internet should verify they have not inadvertently exposed unpatched instances.
- Cloud operators and platform teams: Because the attackers sought AWS and Azure credentials and used Google Cloud IP ranges for evasion, operators should inspect logs for accesses that match the F5-observed patterns and block the identified IP addresses where feasible.
- Incident responders: If an unpatched Vite server was publicly exposed, F5 recommends rotating all secrets within the vulnerable system’s reach. Response teams should also consider searching for signs of exfiltration of Terraform or serverless state files that could reveal persistent or lateral access.
Mitigation steps F5 recommends
F5’s guidance is specific and actionable: update Vite servers to the latest version that patches the exploited flaws; block access to port 5173 where Vite development servers commonly listen; block suspicious /@fs/ requests; and avoid trusting crawler User-Agent strings as a security control. For already exposed, unpatched servers, rotating secrets is emphasized as a necessary follow-up.
The technical details reported by F5 show a familiar pattern: a development tool intended for local use becomes a publicly accessible vector, and attackers quickly weaponize a single weakness to harvest cloud credentials. Whether teams will adopt network-level protections, stricter Docker port hygiene, and rapid secret rotation at scale remains a practical test for organizations that rely on developer-facing services. For operators with exposed Vite instances, the immediate priorities are clear: patch, block the known sources, and rotate secrets.
