Full research report

Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

Two independent research teams found structurally similar but mechanistically distinct prompt injection paths in Atlassian Rovo within weeks of each other, reflecting a systemic weakness in how the assistant processes untrusted input rather than isolated implementation bugs. The RovoBlast path is confirmed closed by a verified Bugcrowd record and Atlassian's own statement; the file-borne indirect injection path disclosed by PromptArmor has no equivalent public confirmation, and this distinction is practically significant because organisations cannot apply either fix themselves — remediation depends entirely on Atlassian's server-side response. A particularly important finding for defenders is that the organisation-level web-search disable setting, which administrators may have treated as a meaningful control against data exfiltration, does not remove the URL-retrieval capability that enables the attack, making it insufficient as a standalone mitigation. Atlassian has published no formal security advisory for either issue and no CVE has been assigned, meaning standard enterprise vulnerability-management processes will not surface these findings without direct monitoring of researcher disclosures from Varonis and PromptArmor.

What happened

Two independent security firms disclosed separate data-exfiltration flaws in Atlassian Rovo, the company's AI assistant integrated with Jira, Confluence, and third-party services. Varonis Threat Labs identified 'RovoBlast', a parameter-to-prompt injection via the rovoChatPrompt URL parameter, disclosed through Bugcrowd and fixed server-side by Atlassian on 8 July 2026 before public presentation at DEF CON 34 on 8 August 2026. PromptArmor independently found a file-borne indirect prompt injection attack, disclosed to Atlassian on 23 May 2026, which remained unresolved at the time of the firm's publication on 5 August 2026. Neither issue carries a CVE identifier and no formal Atlassian security advisory has been published for either.

Affected scope

Atlassian Rovo AI assistant across Standard, Premium, and Enterprise plans; data at risk includes any content reachable by the authenticated victim across Jira, Confluence, Bitbucket, Slack, Microsoft 365, Google Workspace, and SharePoint and Outlook connectors. Rovo is deployed at approximately 75% of Fortune 500 companies and more than 90% of Atlassian enterprise customers.

Technical assessment

Both attacks exploit Rovo's agentic tool-use capabilities without requiring privilege escalation — the victim's own permissions define the data accessible to injected instructions. RovoBlast injected a full attacker-controlled prompt via a URL parameter that Rovo accepted without any warning or disclosure to the user, executing instructions with the victim's privileges on a single click. The file-borne path embedded malicious instructions in uploaded documents; Rovo's URL-retrieval tool then appended gathered data to an attacker-controlled URL and fetched it, leaking contents into the attacker's server logs. A material finding from PromptArmor is that disabling Rovo's organisation-level web-search setting does not remove the underlying URL-retrieval capability, invalidating this toggle as a standalone control. Markdown image rendering in Rovo output was noted as a secondary potential exfiltration channel, though a complete chain was not publicly demonstrated.

Recommended defensive actions

  1. Verify that Atlassian's 8 July 2026 server-side fix for rovoChatPrompt is active in your environment by reviewing your Atlassian admin portal and testing the known parameter pattern in a controlled session
  2. Restrict Rovo's connected integrations to only those strictly necessary, reducing the data accessible to any injected instruction
  3. Audit which Atlassian groups and applications have Rovo access enabled, and remove access from users handling sensitive or regulated data until the PromptArmor-reported file-borne path is confirmed resolved by Atlassian
  4. Monitor Rovo activity logs and network egress for anomalous outbound URL fetch requests to unexpected external domains as a detection signal for active injection attempts
  5. Subscribe to Atlassian's security bulletin channel and the Bugcrowd programme for Rovo-specific advisories, as no formal CVE or advisory has been published and standard patch-management processes will not surface these findings automatically

Uncertainties and evidence gaps

  • Whether Atlassian's 8 July 2026 server-side fix for RovoBlast also addressed the PromptArmor-reported file-borne indirect injection path — no public statement or advisory from Atlassian confirms or denies this
  • Current remediation status of the indirect prompt injection via uploaded files; PromptArmor reported no vendor communication after 25 May 2026 and its publication describes Rovo as vulnerable at that date
  • Whether Markdown image rendering constitutes a viable independent exfiltration channel; PromptArmor identified the vector but did not demonstrate a complete end-to-end chain
  • Full extent of data reachable through third-party connectors (SharePoint, Outlook, Google Workspace, Slack) under prompt injection conditions; the Varonis proof of concept demonstrated access but scope was not exhaustively quantified

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessAuthenticated Rovo user who either clicks a crafted link (RovoBlast path) or asks Rovo to process a document containing attacker-controlled content (file-borne path)
ComponentRovo AI assistant chat interface accepting the rovoChatPrompt URL parameter; Rovo's agentic URL-retrieval tool used during task execution
MechanismAttacker-supplied text is accepted by Rovo as trusted instructions without sanitisation or user-facing disclosure; the URL-retrieval tool lacks controls preventing it from fetching dynamically constructed attacker-controlled URLs, enabling silent outbound data transmission
ImpactAll data reachable by the authenticated victim across connected Atlassian products and third-party services can be gathered and transmitted to an attacker-controlled server within a single user session
DetectionAnomalous outbound URL fetch requests from Rovo to unexpected external domains, visible in Rovo activity logs or network egress monitoring
MitigationRovoBlast (rovoChatPrompt path) fixed server-side by Atlassian on 8 July 2026; for the file-borne indirect injection path, restrict connected app scope and monitor URL-retrieval activity pending confirmed vendor remediation
Exploitation status

No confirmed exploitation in the wild; proof-of-concept attacks demonstrated by PromptArmor (published 5 August 2026) and Varonis Threat Labs (presented at DEF CON 34, 8 August 2026); no CVE assigned and neither issue appears in CISA's Known Exploited Vulnerabilities catalogue

Research process

Investigation began with the supplied article citing two independent researcher disclosures of prompt injection flaws in Atlassian Rovo. Primary sources from both firms were fetched and verified, confirming distinct attack chains with different remediation statuses. A search for formal Atlassian advisories found no published bulletin covering either issue, with the July 2026 security bulletin addressing only traditional product CVEs. SecurityWeek provided independent corroboration from a second domain and surfaced an Atlassian public statement. The investigation concludes with medium confidence: one flaw is confirmed fixed by a Bugcrowd record, one remains of uncertain resolution status at the time of publication.

  1. What does the primary news article report about the two vulnerabilities?
    Fetched The Hacker News article
    thehackernews.com ↗

    Confirmed two independent disclosures: PromptArmor file-borne indirect injection (unresolved at publication) and Varonis RovoBlast rovoChatPrompt parameter injection (fixed 8 July 2026); no CVEs assigned; no post-publication Atlassian update as of 8 August 2026

    why Established the event frame and identified both primary researcher sources requiring independent verification

  2. What are the exact technical details and confirmed fix status for RovoBlast?
    Fetched Varonis Threat Labs primary write-up
    varonis.com ↗

    Confirmed parameter-to-prompt injection via rovoChatPrompt URL; Bugcrowd P2 priority, $6,000 bounty; server-side fix confirmed 8 July 2026; presented at DEF CON 34; no CVE assigned; PoC demonstrated exfiltration of private API key and Jira ticket content

    why Varonis is the primary source for RovoBlast; the Bugcrowd fix record makes this the strongest evidence for the resolved path and sets the baseline for defensive guidance

  3. What are the exact technical details and remediation status for the file-borne indirect injection?
    Fetched PromptArmor primary report
    promptarmor.com ↗

    Confirmed file-upload indirect injection via dynamically constructed URLs; URL-retrieval tool has no controls against attacker-controlled destinations; web-search organisation toggle does not remove the tool; Atlassian unresponsive after 25 May 2026 acknowledgement; published 5 August 2026 as unresolved

    why PromptArmor is the sole primary source for the file-borne path; unresolved status at publication is the key uncertainty driving defensive guidance to restrict Rovo access

  4. Is there independent corroboration and an official Atlassian statement?
    Fetched SecurityWeek article
    securityweek.com ↗

    Independent confirmation from a second outlet; Atlassian stated the fix was deployed before Varonis publication and recommended customers verify that content provided to Atlassian apps comes from trusted sources; no CVE referenced

    why Satisfies the requirement for at least two independent verified source domains and surfaces Atlassian's own public position, which does not address the PromptArmor path

  5. Has Atlassian published a formal security advisory or CVE for either issue?
    Fetched Atlassian July 2026 security bulletin and Atlassian Community Rovo security thread
    confluence.atlassian.com ↗

    The July 2026 bulletin covers only traditional product dependency CVEs with no mention of Rovo, prompt injection, or rovoChatPrompt; the Community forum thread shows user-reported Rovo security findings under investigation with no published CVE or fix confirmation from Atlassian

    why Absence of a formal advisory means defenders cannot rely on standard patch-management or vulnerability-tracking processes to surface these findings; this is a material gap that elevates the importance of direct researcher source monitoring

Named in this story
TargetsAtlassian Rovo enterprise usersJiraConfluenceBitbucketSharePoint and Outlook connectors via Rovo

Research coverage

All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok5 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1662 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory stale fallback0 records Failed The current collection attempt failed; this source cannot support the report.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok677 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1008 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1589 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok7 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 6 opened outside the registered collection
References & evidence
PoC & exploit code2
RovoBlast: How One Click Triggered Atlassian's AI Assistant to Leak Data varonis.com ↗

Primary technical write-up for the rovoChatPrompt parameter injection; confirms Bugcrowd P2 rating, $6,000 bounty, and server-side fix on 8 July 2026

Atlassian Rovo Exfiltrates Data, Bypassing Controls promptarmor.com ↗

Primary write-up for the file-borne indirect prompt injection path; reported unresolved as of publication on 5 August 2026

Analysis & research2
Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data securityweek.com ↗

Independent corroboration from a second outlet; includes Atlassian's public statement on the fix

Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers thehackernews.com ↗

Secondary reporting aggregating both disclosures; confirms no post-publication Atlassian update as of 8 August 2026