"On the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended," Vite said in an advisory for the flaw in April 2026.
CVE-2026-39364 and the exposed Vite development server
Security researchers have linked a mass-scanning campaign observed in August 2026 to a high-severity flaw in Vite tracked as CVE-2026-39364 (CVSS 8.2). The vulnerability allows an unauthenticated attacker to bypass security restrictions by manipulating query parameters and thereby leak files that the server.fs.deny setting is intended to block.
F5 Labs summarized how an affected application becomes reachable: "Under default configurations, Vite binds to localhost." The server becomes vulnerable when operators explicitly expose the Vite dev server to the network using the --host flag, set server.host, or misconfigure Docker container port mappings.
How the exploit is executed: the /@fs/ endpoint and bypass parameters
The attacker's technique is straightforward and repeatable. Malicious actors issue HTTP GET requests to the /@fs/ endpoint that reference a sensitive file path and append query parameters such as ?raw, ?import&raw, or ?import&url&inline. When these parameters are present, the server processes the request while undermining the server.fs.deny check and returns the requested file contents in plaintext with an HTTP 200 response.
F5 Labs noted that successful exploitation requires three conditions to be met:
- the Vite dev server be explicitly exposed to the network using --host or server.host;
- the sensitive file exist in the allowed directories specified by server.fs.allow; and
- the sensitive file be denied by a pattern that matches server.fs.deny.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleData types observed exfiltrated in reconnaissance and theft
F5 Labs reported seeing requests that were consistent with reconnaissance and credential extraction; the types of data targeted or retrieved include:
- Environment configurations
- AWS credentials
- AWS configurations and backups
- Infrastructure state files such as terraform.tfstate and serverless.yml
- Azure profiles
- System memory and environment details (for example, /etc/passwd, /proc/self/environ, /proc/1/environ, and /proc/self/cwd/.env)
F5 Labs specifically highlighted probing of /proc/self/cwd/.env as demonstrating "an understanding of the deployment stack, reading the active .env file relative to the running process without needing to guess the absolute web application path."
Attack patterns: forged headers, crawler impersonation, and cloud IP ranges
The malicious requests used forged and deceptive metadata to evade detection and confuse analysis. Attackers set bogus User-Agent headers impersonating major web crawlers and AI indexing bots — for example: Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot. They also injected forged X-Forwarded-For and X-Real-IP values (the source gives examples 34.94.237[.]62 and 104.28.219[.]193) to bypass IP-based access lists and complicate log review.
F5 Labs observed a significant portion of the malicious activity originating from the U.S., Belgium, the Netherlands, Singapore, and Taiwan. Much of the traffic came from Google Cloud Platform ranges (noted as 34.x and 35.x in the reporting), a choice the researchers say the attackers used "to fly under the radar."
What this means for developers, cloud operators, and incident responders
- Developers and DevOps teams: Exposing the Vite development server to the network (for example, via --host, server.host, or misconfigured container ports) is the central risk described; teams will need to verify server.fs.allow and server.fs.deny configurations and avoid publicly reachable dev servers.
- Cloud operators and infrastructure owners: The campaign demonstrates that plaintext cloud credentials, AWS configurations and backups, and infrastructure-as-code state files (terraform.tfstate, serverless.yml) are attractive targets; operators should treat any exposed development server as a high-priority avenue for credential theft.
- Incident responders and log analysts: The use of forged User-Agent strings and injected X-Forwarded-For/X-Real-IP values complicates attribution and filtering. Observed example IPs and the attackers' use of Google Cloud Platform ranges (34.x, 35.x) are concrete indicators to examine when triaging suspected exploitation.
This campaign underlines a recurring theme: a development convenience — an exposed dev server — paired with a precise query-parameter bypass can convert local configuration files into broadly available plaintext secrets. The campaign was active in August 2026, exploited CVE-2026-39364, and relied on simple GET requests to /@fs/ plus a small set of parameters to return sensitive files with HTTP 200 responses. For defenders, the immediate takeaways are narrow and specific: confirm whether Vite dev servers are reachable beyond localhost, audit server.fs.allow and server.fs.deny placements, and scrutinize logs for requests that include the bypass parameters and crawler-like User-Agents.
Original reporting: https://thehackernews.com/2026/09/mass-scanning-campaign-exploits-vite.html
