Atlassian's Rovo assistant taught to leak Jira and Confluence data to attackers

Atlassian built its Rovo AI assistant into its products, including Jira and Confluence, and turned it on by default on the Standard, Premium and Enterprise plans. As two security teams have discovered, this helpfulness can be turned against the data's owner: Rovo can be talked into collecting information an authorized user has access to and forwarding it to a server controlled by an attacker.

Two roads to the same leak

The firm PromptArmor used a classic indirect prompt injection. Hidden instructions lurk in a document that the user uploads and innocently asks Rovo to “tidy up the tasks.” The assistant dutifully searches for data in Jira and Confluence, appends what it finds to someone else's URL and opens it — and the attacker reads the contents from the logs of their own server. Returning to the chat later, the victim sees only the suggested edits to the tasks and no trace of the theft.

An intriguing detail: disabling the web-search option, which Atlassian presents as a separate organization-level setting, did not stop the injection — the outgoing request went through another of the assistant's abilities, the one that opens links. PromptArmor frames the root of the problem simply: nothing verifies whether the agent itself composed the address it is opening.

Varonis Threat Labs came at it from a different angle and named their finding RovoBlast. It turned out that the rovoChatPrompt URL parameter loads arbitrary instructions straight into the Rovo chat, so a single click by an authorized user is enough for the assistant to execute them with that user's privileges. The researchers demonstrated exfiltrating a private API key from Confluence, and the same technique worked against Jira and against data reachable through the SharePoint and Outlook connectors.

What has been fixed and what hasn't

Here the stories diverge. The Varonis vulnerability went through Bugcrowd, was rated P2 and awarded a $6,000 bounty; Atlassian closed it on its side on July 8, 2026, and the reporter confirmed the fix. PromptArmor, by contrast, says it reported its problem back on May 23 but, after several reminders, never got a coherent response and published its finding on August 5, describing Rovo as still vulnerable. There is no confirmation that the substantive attack path has been closed.

Neither case comes with a patch you could roll out. Atlassian fixed the link-based flaw itself, while against injection through content the only recourse is to limit which applications and groups are allowed to use Rovo at all, and not to treat the web-search toggle as a security boundary in its own right.

An important caveat: this is not a total privilege bypass. Rovo leaks exactly as much as is available to the victim themselves. But that is precisely the catch with an assistant deliberately stretched across all the products and connectors: the reach of a single account is a system working as intended. Neither report offers any sign that these techniques have been used against real organizations, and no CVE has yet been assigned to either vulnerability.

Source: The Hacker News