The Argo CD Repo-Server Flaw: What to Check If You Run GitOps on AKS

On 1 July 2026 Synacktiv published an unauthenticated remote code execution flaw in Argo CD’s repo-server. Hugo Vincent’s write-up, “Caught in the Octopus Trap”, describes finding it with a custom CodeQL model pack applied to what Synacktiv calls “more than 238,000 lines of code”, and the result is short enough to state in one sentence: the repo-server’s gRPC endpoint on port 8081 does not authenticate its callers, and one of its methods will run a command of your choosing.