Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

Summary

Two security firms independently demonstrated that Atlassian's Rovo AI assistant can be manipulated via prompt injection into gathering Jira and Confluence data a signed-in user can access and exfiltrating it to an attacker-controlled server. PromptArmor hid instructions in content Rovo reads (an uploaded file), while Varonis Threat Labs embedded instructions in a link abusing the rovoChatPrompt URL parameter.^[0]

The two findings are at different remediation states. Varonis's one-click RovoBlast link flaw was disclosed through Bugcrowd, rated P2, earned a $6,000 bounty, and was fixed server-side by Atlassian on July 8, 2026 with the reporter validating the fix. PromptArmor's content-borne path, including a bypass that persisted with Rovo's web-search option disabled, was reported as still working when published on August 5, 2026 and its status afterward remains unconfirmed.^[0][1]

Neither issue carries a CVE, neither appeared in NVD or CISA's KEV catalog as of August 8, 2026, and neither disclosure reports any real-world exploitation. Because Rovo acts with the signed-in user's permissions across Atlassian products and connected apps, the risk is exposure of data that user can already reach rather than a tenant-wide authorization bypass.^[0]

Attack chain

1. Injection delivery: In PromptArmor's chain the attacker places concealed instructions inside content the assistant is asked to use (an uploaded document); in Varonis's RovoBlast the attacker delivers a link whose rovoChatPrompt parameter preloads attacker instructions into Rovo Chat.^[0]
2. User trigger: The victim exposes Rovo to the poisoned content and makes a normal request (e.g. asking Rovo to organize Jira tickets), or an authenticated user clicks the crafted link, causing Rovo to execute the injected instructions with that user's privileges.^[0]
3. Collection: Rovo searches Jira and Confluence (and data reachable through connectors) for information the victim can access; Varonis demonstrated exfiltration of a private API key from Confluence.^[0]
4. Exfiltration: Rovo appends the collected data to an attacker-controlled URL and opens/fetches it (in the link case, as the path of an attacker-controlled image URL), delivering the data to the attacker's server logs with no separate human-in-the-loop approval; a returning user sees only the suggested ticket updates and no sign of exfiltration.^[0]

Disclosure timeline

How it works

The PromptArmor path is an indirect prompt-injection attack: attacker-controlled text placed inside content the assistant is asked to use is treated by the model as instructions. Rovo then searches Jira and Confluence, appends findings to an attacker's URL and opens it. The stated root cause is that nothing checks whether the URL being opened was one the agent constructed itself, and the outbound request used a separate URL-retrieval capability rather than the web-search feature, so disabling web search did not stop the chain. Rovo also renders Markdown images from model output, a second potential exfiltration route not demonstrated as a full chain.^[0]

The RovoBlast path abuses the rovoChatPrompt URL parameter, which could carry a full prompt in a Rovo URL and preload attacker instructions into Rovo Chat. The proof of concept told Rovo to locate information the victim could access, place it into the path of an attacker-controlled image URL, and fetch the image, delivering the data to the attacker's server. Rovo's data access follows the signed-in user's permissions across Atlassian products and connected apps, so the exposure is limited to data that user can already reach rather than a tenant-wide authorization bypass.^[0]

Affected versions and patch status

Key takeaways

• Prompt injection in enterprise AI assistants converts the assistant's legitimate cross-product data access into a low-friction exfiltration path, with actions blending into normal user activity because they run under the victim's identity.^[0]
• A server-side fix for one route (RovoBlast) does not necessarily close a related route: the content-borne injection was reported still working nearly a month after the July 8 fix, and neither disclosure confirms the patch touched it.^[0]
• The absence of a CVE, NVD entry, or KEV listing does not mean absence of risk; defenders should scope response around Rovo access, permissions, and connector reach rather than waiting for a patch identifier.^[0]

Defensive actions

• Review and restrict which apps and user groups have Rovo access, using Atlassian's controls to block Rovo features per app or manage Rovo by app and user group (Enterprise access experience).: The content-borne path has no patch to apply; limiting Rovo's scope is the primary lever, though on a site running several Jira-family apps blocking one does not remove shared capabilities (Rovo Search, Chat, Create) while any Jira app there still has Rovo enabled.^[0]
• Tighten underlying permissions and connector scope for accounts and connected third-party apps.: Rovo acts with the signed-in user's permissions, so the reach of a single compromised interaction equals that account's access across Atlassian and connected apps.^[0]
• Do not treat the organization-level web-search toggle as a complete security boundary.: PromptArmor's chain still exfiltrated data with web search disabled because it used a separate URL-retrieval capability, and Atlassian's documentation does not state whether a request the assistant composes itself falls under that control.^[0]