F5 Labs says a mass-scanning campaign in August 2026 is actively exploiting Vite dev servers through CVE-2026-39364 to pull AWS and Azure credentials, config files, and infrastructure state from exposed deployments. The activity targets internet-reachable development servers, not local-only setups.
The flaw uses query-string tricks such as ?raw and ?import&raw to make Vite return files that server.fs.deny should block, so a reachable dev server can hand back plaintext .env files, cloud profiles, and Terraform state. That means the attacker is not breaking into AWS or Azure first; they are stealing the keys and setup files that already sit beside the app.
For teams that expose Vite to a network, the exposed box is now the cloud foothold, and patching the server only closes the file leak going forward. Anything already readable from those local config paths may still be in attacker hands, and reused secrets can outlive the vulnerable server itself.
Hackers target exposed Vite dev servers to steal AWS, Azure secrets
A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments.