The vulnerability
CVE-2026-39364 is a path traversal and authentication bypass in the Vite development server affecting versions 7.1.0 through 7.3.2 and 8.x before 8.0.5. The vulnerability allows an unauthenticated attacker to bypass file access controls by manipulating HTTP GET requests, enabling them to read arbitrary files from the filesystem. In practice, attackers are targeting environment files (.env, .env.local, .env.production) that commonly contain cloud provider access keys, database connection strings, and API secrets. Terraform configuration files and serverless deployment manifests are also targeted.
Vite is a widely used JavaScript build tool and development server. It is not a production server, but many teams leave it exposed to the internet for convenience during development or bind it to all interfaces in shared development environments.
The scale of exploitation
F5 researchers detected over 800 attacks and approximately 32,000 related events in a single month. The scanning is automated and indiscriminate: attackers are not targeting specific organizations but are searching for any exposed Vite dev server at any IP address. Most malicious traffic originated from Google Cloud IP ranges based in the United States, Belgium, and the Netherlands, a technique that uses legitimate cloud egress to evade IP-based blocklists.
The campaign also leveraged earlier Vite vulnerabilities: CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811. Attackers are running multi-CVE playbooks against Vite, which means the target is any version that has not been kept current.
What attackers take
The primary target is cloud credentials. An AWS access key and secret stored in a .env file gives an attacker the same cloud access the application has, which often includes object storage, compute, database, and secrets-manager access. Azure service principal credentials and client secrets carry equivalent risk. Terraform state files may contain additional secrets and describe the full infrastructure topology.
What to do right now
Patch Vite to version 7.3.2 or 8.0.5. Check the installed version with 'vite --version' or in package.json. Where patching is not immediate, bind the development server to localhost (127.0.0.1) rather than 0.0.0.0, or place it behind a VPN-gated network boundary.
Rotate any credentials that were in .env files on systems running affected Vite versions. If you are uncertain whether your dev server was exposed, check access logs for unexpected GET requests with path manipulation patterns. Treat any ambiguous access as a compromise indicator and rotate.
Review your cloud accounts for unexpected API calls, newly created access keys, or permissions changes originating from unfamiliar IP addresses. AWS CloudTrail and Azure Monitor activity logs are the starting point.
The structural issue
Development servers do not belong on the public internet. When development environments sit on the same network as production infrastructure and share credentials with it, a development-side compromise becomes a production-side breach. The mitigations are not Vite-specific: isolate developer infrastructure, rotate credentials between environments, and apply network controls to development tooling with the same rigor as production services.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your team needs to assess cloud credential exposure or developer infrastructure security.