Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
Summary: F5 Labs disclosed a mass-scanning campaign, observed in August 2026, that targets internet-exposed Vite development servers to steal AWS and Azure cloud credentials, configurations, and infrastructure state files by exploiting CVE-2026-39364, a high-severity flaw (CVSS 8.2) that bypasses server.fs.deny through query parameter manipulation. Attackers send HTTP GET requests to the /@fs/ endpoint with parameters such as ?raw and ?import&raw to retrieve files like .env and *.crt in plaintext, using forged User-Agent headers impersonating Googlebot, ClaudeBot, GPTBot, and others, plus spoofed X-Forwarded-For and X-Real-IP values, with much activity originating from the U.S., Belgium, the Netherlands, Singapore, and Taiwan via Google Cloud Platform ranges.
Bottom line: The flaw only matters when a developer exposes the dev server beyond localhost, and the payoff is plaintext API secrets, database passwords, and cloud administrative credentials - so one --host flag or misconfigured Docker port mapping turns a development convenience into a credential leak.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2026-39364
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026