Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers Contact/Tip Us Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback! Follow Us On Social Media RSS Feeds Email Alerts Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers Swati Khandelwal Aug 08, 2026 AI Security / Enterprise Security Attacker-controlled instructions can make Atlassian’s Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor , an AI security firm, hid the instructions in content Rovo reads. It said an uploaded file was enough to make the assistant gather internal data and send it out through a URL request, with no separate approval step. The firm published on August 5, 2026 and said the chain still worked with Rovo’s web-search option switched off. That bypass is single-sourced, and the report establishes the finding’s status only on that date; a later remediation is not confirmed here. Varonis Threat Labs put the instructions in a link instead. It found that the rovoChatPrompt URL parameter would preload attacker instructions into Rovo Chat, so one click from an authenticated user was enough for Rovo to run them with that user’s privileges and send the results to an attacker-controlled server. Varonis calls the flaw RovoBlast and says it disclosed the issue through Bugcrowd. The Bugcrowd record shows Atlassian fixed it server-side on July 8, 2026, and the reporter validated the fix. Neither issue leaves customers a patch to apply: the link flaw was closed on Atlassian’s side, and the lever for the content-borne path is scoping which apps and groups can use Rovo at all. The file that carries orders The PromptArmor chain is an indirect prompt-injection attack : attacker-controlled text is placed inside content the assistant is asked to use, and the model treats some of that text as instructions. In the firm’s published example, a user uploads a document carrying a concealed injection and asks Rovo to organize their Jira tickets. Rovo searches Jira and Confluence as asked, appends what it finds to an attacker’s URL and opens it, and the attacker reads the ticket and page contents out of their own server logs. PromptArmor said a user returning to the chat later sees the suggested ticket updates and no sign of the exfiltration. The interaction is not cleanly described as zero-click. The victim still has to expose Rovo to the poisoned content and make a normal request. PromptArmor’s narrower claim is that the exfiltration step does not require a separate human-in-the-loop approval. The web-search finding matters because Atlassian offers web search as a separate organization-level setting that lets users expand Rovo’s sources to public websites. PromptArmor said disabling that option did not stop its chain, because the outbound request used a separate URL-retrieval capability. It put the root cause plainly: nothing checks whether the URL being opened was one the agent constructed itself. The report also notes Rovo renders Markdown images from model output , a second way data could leave, though it does not demonstrate a full chain through that route for Rovo. The web-search bypass remains attributed to PromptArmor rather than treated as independently reproduced. Atlassian’s page for that setting does not say whether a request the assistant composes and fetches on its own falls under the same control. That is the question the finding raises for anyone deciding what the toggle is worth. PromptArmor said it disclosed the issue to Atlassian on May 23, 2026, received a case number two days later, followed up on June 4 and again on July 29, and published after what it described as no further communication. The Hacker News found no post-publication update to that report as of August 8, 2026, and its text still describes Rovo as vulnerable at the time it went out. That was nearly a month after the July 8 fix landed, and neither disclosure says whether that change touched the content-borne path. The one-click link flaw is fixed The Bugcrowd disclosure gives the firmer record of the two, and Varonis has published a fuller account of the attack. The rovoChatPrompt parameter could carry a full prompt in a Rovo URL . The proof of concept told Rovo to locate information the victim could access, put it into the path of an attacker-controlled image URL and fetch the image. That request delivered the data to the attacker’s server. The reporter demonstrated exfiltration of a private API key from Confluence, and Bugcrowd says the same one-click technique was tested against Jira and data reachable through SharePoint and Outlook connectors. The report is rated P2 on Bugcrowd’s priority scale and drew a $6,000 bounty; Atlassian deployed the server-side fix on July 8, and the report is marked resolved. Neither disclosure carries a CVE identifier, and searches of NVD and CISA’s Known Exploited Vulnerabilities catalog returned none for either issue as of August 8, 2026. Permissions, and what can be switched off Rovo’s data access follows permissions configured in Atlassian products and connected third-party apps. The risk shown is therefore data the signed-in victim can reach, not a demonstrated tenant-wide authorization bypass. The demonstrations add a route for permitted data to leave, with the person holding those permissions never choosing to send it. That distinction should shape how the risk is scoped rather than shrink it: in an assistant deliberately wired across Atlassian products and connected third-party apps, the reach of a single account is the product working as intended. Rovo is on by default for apps on Standard, Premium, and Enterprise plans, and everyone in an organization can use its features, according to Atlassian’s documentation. Administrators are not limited to an all-or-nothing choice. Organizations can block Rovo features for supported apps , which disables current and upcoming AI features for that app, including Agents and Chat. Enterprise’s newer access experience can also manage Rovo by app and user group. Atlassian documents one caveat: on a site running several Jira-family apps, blocking one of them does not remove the shared capabilities. Rovo Search, Chat and Create with Rovo stay available as long as any Jira app on that site still has Rovo enabled. The link flaw is already fixed on Atlassian’s side, so the immediate response is narrower than it looks. For the separate content-borne risk, organizations can review which apps and groups have Rovo access, tighten underlying permissions and connector scope, and avoid treating the web-search toggle by itself as a complete security boundary. Neither disclosure reports evidence that either technique has been used against a real organization. That is a statement about what the two reports contain, not a finding that no such activity has occurred. One path is confirmed closed. PromptArmor said the other was unresolved when it published on August 5; its status after that date remains unconfirmed. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post. SHARE Tweet Share Share Share Share on Facebook Share on Twitter Share on Linkedin Share on Reddit Share on Hacker News Share on Email Share on WhatsApp Share on Facebook Messenger Share on Telegram SHARE AI Security , Application Security , Cloud security , data security , enterprise security , Prompt Injection , SaaS Security , Vulnerability , Web Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders Cybersecurity Webinars Risk in AI-Generated Code How to Secure AI Code Before It Reaches Production Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale. Register Build AI Securely How to Secure AI-Built Software at Machine Speed Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed. Register ⚡ Latest News Cybersecurity Resources 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Burp, sqlmap, SSRF, XXE, SSTI: Web Exploitation, Hands-On 35 labs plus a live CTF take you from recon to remote code execution. GWAPT prep, SANS CDI in D.C. SANS AI Cybersecurity Summit Returns This November Learn how practitioners are applying AI to today’s cybersecurity challenges. Expert Insights Articles Videos How AI-Assisted Attacks Are Breaking Legacy SIEM Tools August 3, 2026 Read ➝ A Look Inside Lasso’s AI Security Platform July 27, 2026 Read ➝ Claude Runs Across Six Surfaces in Your Company. Your Security Team Sees One. July 27, 2026 Read ➝ How to Make Social Engineering Unprofitable July 22, 2026 Read ➝ Get the Latest News in Your Inbox Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free. Email
Menu
