F5 Labs says its honeynet sensors recorded a sustained, automated scanning campaign in August that targeted internet-exposed Vite development servers to steal cloud credentials, AWS and Azure configuration files, and infrastructure-as-code state files. The campaign generated more than 800 grouped attack sessions and roughly 32,000 raw events over the monitoring window, anchored by exploitation of CVE-2026-39364, a high-severity, unauthenticated file-read vulnerability affecting Vite versions 7.1.0 up to 7.3.2 and 8.0.5. “Under default configurations, Vite binds to localhost,” F5 Labs researcher Adam Metcalfe-Pearce wrote in the company’s Sensor Intel Series. “When developers expose the service by passing the –host flag, setting server.host, or misconfiguring Docker container port mappings, the development server becomes directly reachable over the local network or public internet.”
What makes this campaign notable is what it targets. Vite is a development tool, not production infrastructure, so its exposure is almost always a configuration mistake rather than an intentional deployment. Attackers are treating that mistake as reliably common enough to scan for at scale, systematically working through wordlists of environment files and cloud credential paths rather than targeting a single known file. That scale, more than the CVE itself, is the story: F5 Labs’ telemetry shows attackers have already folded a bypass technique disclosed in April into automated, high-volume credential-harvesting infrastructure within months.
The original insight for defenders is that this vulnerability requires no authentication and no user interaction to exploit, and its blast radius depends entirely on what happened to be reachable through the developer’s own filesystem permissions. This mirrors a pattern CyberTech has covered before, where a fix ships and adoption still lags the threat, as documented in CyberTech’s reporting on CISA’s shrinking patch-adoption deadlines. Teams should confirm no Vite dev server is bound to a network-reachable host or exposed through a misconfigured container port mapping, upgrade past 7.3.2 or 8.0.5, and audit exposed instances for the credential and infrastructure files F5 Labs says attackers are targeting, a step that also matters for the AI-assisted coding tools now embedding Vite in cloud workflows, per CyberTech’s recent coverage of AI-security tooling gaps.
Source: F5 Labs
