Atlassian Rovo Prompt Injection: Jira and Confluence Data at Risk

Key Takeaways

• Two independent research teams disclosed separate prompt-injection attack paths against Atlassian’s Rovo AI assistant in 2026, both capable of exfiltrating Jira tickets, Confluence pages, and data from connected SharePoint and Outlook connectors using only the access already granted to a signed-in user [1][2].
• Varonis Threat Labs’ “RovoBlast” technique abused the rovoChatPrompt URL parameter to preload attacker instructions into Rovo Chat; Atlassian deployed a server-side fix on July 8, 2026, and Varonis validated the remediation before publishing its research and receiving a $6,000 Bugcrowd bounty for the P2-rated finding [1][3].
• PromptArmor’s content-based technique hides instructions inside an uploaded document and directs Rovo to exfiltrate data through its own URL-retrieval tool — a path that PromptArmor reported it disclosed to Atlassian on May 23, 2026, and that remained unresolved when PromptArmor published its findings on August 5, 2026, more than two months after its initial report [1][12].
• Neither technique has been assigned a CVE identifier as of this writing, and neither research team reported evidence of exploitation against a live customer environment; the risk described here concerns disclosed capability, not confirmed in-the-wild abuse [1].
• Rovo’s scale amplifies the stakes of both findings: a compilation of Atlassian’s public disclosures shows the assistant surpassing five million monthly active users and completing 2.4 million agent automations over a six-month span, against a customer base in which more than 80% of Fortune 500 companies participate — meaning a durable exfiltration path in Rovo has a correspondingly large potential blast radius [6].

Background

Rovo is Atlassian’s generative AI layer across its Cloud platform, surfaced through Rovo Chat, Rovo Search, and Rovo Create, and enabled by default across Standard, Premium, and Enterprise plans. It authenticates as the signed-in user and inherits that user’s existing permissions across Jira, Confluence, and a growing set of connected third-party applications, including SharePoint, Outlook, and other enterprise systems reachable through Atlassian’s connector framework. Atlassian has publicized Rovo’s reach through adoption figures compiled from its own disclosures: more than five million monthly active users, and — describing Atlassian’s broader customer base rather than Rovo adoption specifically — more than 80% of Fortune 500 companies among its customers, alongside 2.4 million automations completed by Rovo agents over a six-month period [6]. Those figures describe provisioning and platform-wide reach more than day-to-day engagement with Rovo itself — Rovo ships on by default for most enterprise Cloud customers, so its footprint is broader than voluntary daily use would suggest — but they still describe an assistant with standing, permissioned access to a large share of enterprise Jira and Confluence content.

That reach is a significant part of what makes Rovo an attractive target for indirect prompt injection, a well-documented attack pattern in which an AI agent processes attacker-controlled text embedded in content it was asked to summarize, retrieve, or act on, and treats fragments of that text as instructions rather than as data. The pattern is not unique to Rovo. CSA’s own research has tracked indirect prompt injection moving from theoretical proof-of-concept to live, operational exploitation across agentic platforms generally over the course of 2026 [7]. What distinguishes the Rovo disclosures is that the exfiltration channel is not a novel side effect discovered by researchers after the fact — it is the assistant’s own designed capability to fetch and act on external content, which two research teams independently found could be redirected against the organization that deployed it.

Two teams reported distinct exploitation paths in mid-2026. Varonis Threat Labs, working through Atlassian’s Bugcrowd program, identified a URL-parameter-based technique it named RovoBlast. PromptArmor, working through direct disclosure to Atlassian, identified a document-based technique that abuses Rovo’s own retrieval tooling. Both findings point to a common underlying pattern: Rovo’s process for handling instructions appears not to reliably distinguish between instructions that originate from the authenticated user and instructions that arrive embedded in content or parameters the assistant is asked to process.

Security Analysis

RovoBlast: parameter-to-prompt injection via a single click

RovoBlast exploits a URL parameter, rovoChatPrompt, that Atlassian’s Rovo Chat interface accepted and rendered as an active conversational instruction. A link constructed in the pattern https://home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt=<attacker text> would, when clicked by an authenticated user, surface the attacker’s embedded text inside Rovo Chat “without warning [or] confirmation,” in Varonis’s description, and execute it with that user’s session and privileges [3][4]. Varonis researcher Dolev Taler characterized the mechanism directly: “A single click on a link triggers the attacker’s embedded instructions and forces Rovo to accept externally supplied parameters as trusted inputs” [4]. Because Rovo’s ResearchAgent capability can autonomously chain multi-step actions — retrieving Jira tickets, summarizing Confluence pages, and reaching into any of the more than fifty enterprise platforms Rovo can connect to, including Slack, Microsoft 365, and Google Workspace — a single seeded link was sufficient to trigger data retrieval and exfiltration without requiring a jailbreak, stolen credentials, or any demonstrated bypass of Rovo’s underlying authorization model [4][5]. This pattern is sometimes described as parameter-to-prompt (P2P) injection: content technically outside the conversational turn — here, a URL query string — is treated by the application as if it were a trusted, first-party instruction.

Varonis disclosed RovoBlast to Atlassian through Bugcrowd, where it was rated P2 priority and awarded a $6,000 bounty. Atlassian deployed a server-side fix on July 8, 2026, and Varonis validated that fix before publishing its findings [1][3]. Consistent with the scoping of Rovo’s permission model, Varonis noted that RovoBlast did not grant an attacker unrestricted access to an entire Atlassian tenant; exposure was bounded by whatever the clicking user’s own account could already reach [3].

Content-based exfiltration through Rovo’s own retrieval tool

PromptArmor’s technique targets a different surface: rather than pre-loading a chat prompt through a URL, it embeds hidden instructions inside a document a legitimate user uploads to Rovo for an ordinary task, such as organizing or summarizing Jira tickets. When Rovo processes the document, it processes the concealed instructions in the same context as the user’s genuine request, and — per PromptArmor’s account — can be directed to assemble Jira ticket contents or Confluence page text into a URL and then trigger Rovo’s own URL-retrieval tool against an attacker-controlled server, at which point the data arrives in that server’s access logs [1][12]. The exfiltration occurs without any explicit user approval beyond the initial document upload and query, and PromptArmor reported that the technique succeeds even when an organization has disabled Rovo’s web-search toggle, because that setting does not remove Rovo’s underlying capability to open URLs — it curtails one entry point to that capability without closing the capability itself [1][12]. PromptArmor also flagged a secondary path through Rovo’s Markdown image-rendering behavior as a further avenue for exfiltration by way of externally hosted image URLs [12].

PromptArmor stated it disclosed the vulnerability to Atlassian on May 23, 2026, and received case-number confirmation within two days, on May 25. It followed up on June 4 and again on July 29 without receiving a substantive update, and published its findings publicly on August 5, 2026, describing the issue as unresolved at that time [1][12]. Reporting on the disclosure as of August 8, 2026, noted that the status of the fix after PromptArmor’s publication date remained unconfirmed, and that searches of the National Vulnerability Database and CISA’s Known Exploited Vulnerabilities catalog turned up no CVE assignment for either the RovoBlast or the content-based finding [1].

A shared architectural gap, not two unrelated bugs

The two disclosures illustrate the same underlying problem from different entry points: Rovo’s process for turning retrieved or supplied content into action does not adequately separate what a trusted user asked for from what untrusted content — a URL parameter, an uploaded file — appears to ask for. An assistant that ingests untrusted content, executes tools against sensitive user data, and retains an egress path that a successful injection can influence will remain exposed regardless of how well its underlying language model is tuned to resist instruction-following abuse in isolation. Disabling a single feature toggle, as Atlassian’s web-search setting demonstrates, does not close an egress path if the assistant retains an adjacent capability that reaches the same destination — the same lesson CSA’s research on AI agent sandbox and isolation claims has drawn from unrelated platforms: a vendor’s “isolation” or “restriction” setting should not be treated as a complete security boundary unless it specifies exactly which underlying capabilities and protocols remain reachable [8].

Recommendations

Immediate Actions

Organizations running Rovo should inventory which applications, connectors, and user groups have Rovo access enabled, and should not assume that Atlassian’s web-search toggle constitutes a complete boundary against outbound data flows, given PromptArmor’s finding that the toggle did not remove Rovo’s URL-retrieval capability [1][12]. Security teams should confirm that any tenant still running against pre-July 8, 2026 server-side behavior has received Atlassian’s RovoBlast fix, and should treat unsolicited or externally sourced links containing chat-related URL parameters as a phishing-adjacent risk warranting the same user caution applied to credential-harvesting links [3][4].

Short-Term Mitigations

Enterprises should tighten permission configurations for applications and connectors reachable through Rovo, consistent with least-privilege principles, since both disclosed attacks operate within — rather than around — the clicking or uploading user’s existing access [3][5]. Where the sensitivity of a workspace warrants it, organizations should use Atlassian’s Enterprise-tier access management controls to disable Rovo for specific applications, projects, or user groups handling legal, HR, financial, or other high-sensitivity content, rather than relying on assistant-side behavioral settings alone [1]. Egress monitoring or allowlisting for outbound requests initiated by Rovo’s agent tooling would provide a compensating control against the underlying retrieval-tool exfiltration path that PromptArmor described, independent of whether or when Atlassian ships a fix for that specific technique [8][12].

Strategic Considerations

The RovoBlast and content-based disclosures reinforce a pattern CSA has tracked across multiple agentic AI platforms in 2026. CSA’s assessment, based on this and prior disclosures, is that architectural separation between trusted instructions and untrusted content — not incremental model tuning — offers a more durable closure of these exposure paths than point fixes alone [7][8]. Organizations evaluating or continuing to deploy AI assistants with standing access to ticketing and documentation systems should treat that architectural separation — deterministic policy enforcement over tool calls, egress allowlisting independent of user-facing toggles, and provenance tracking for content an agent is asked to act on — as a procurement and configuration criterion, not an assumption to be revisited only after a vendor discloses a fix.

CSA Resource Alignment

The Rovo disclosures map most directly to CSA’s research note AI Agent Trust Boundaries: DNS Escape and Exfiltration Flaws (2026), which examined how an AWS Bedrock AgentCore isolation mode marketed as blocking outbound network access could still be bypassed for data exfiltration because the underlying protocol path was never actually closed. That research concludes that vendor claims of “isolation” or “restriction” should be treated as incomplete security claims unless they specify exactly which capabilities and protocols remain reachable — precisely the failure PromptArmor documented in Rovo, where disabling the web-search toggle left the underlying URL-retrieval tool available to an injected instruction [8].

CSA’s Indirect Prompt Injection Goes Operational (2026) documents the broader 2026 shift of indirect prompt injection from proof-of-concept research to live exploitation across agentic platforms, and its guidance on orchestrator-mediated tool calls and source attestation as blast-radius controls applies directly to how Rovo mediates access to Jira, Confluence, and connected third-party data [7]. CSA’s Agent Data Injection: A New Attack Class Beyond Prompt Injection (2026) is a useful forward-looking complement: it shows that defenses purpose-built to block conventional prompt injection can still be bypassed by corrupted metadata rather than direct instructions, reinforcing that a fix for RovoBlast or the content-based path does not guarantee coverage against the next variant of injection Rovo’s architecture may expose [9].

Organizations should also consult CSA’s AI Controls Matrix (AICM) v1.1, whose control domains covering data protection, access control, and agent authorization provide an auditable basis for the permission-scoping and egress-control recommendations above, and CSA’s MAESTRO agentic AI threat modeling framework, which offers a structured way to locate this class of vulnerability — content ingestion feeding tool execution with an influenceable egress path — within an organization’s broader agentic AI threat model rather than treating each vendor disclosure as an isolated event [10][11].

References

[1] The Hacker News. “Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers.” The Hacker News, August 8, 2026.

[2] TechNadu. “Atlassian Rovo AI Prompt Injection Exfiltrates Jira, Confluence Data.” TechNadu, August 2026.

[3] Varonis Threat Labs. “RovoBlast: How One Click Triggered Atlassian’s AI Assistant to Leak Data.” Varonis, 2026.

[4] CSO Online. “One-Click Flaw in Atlassian Rovo Exposed Enterprise Data via Prompt Injection Attack.” CSO Online, 2026.

[5] Cybersecurity News. “Atlassian Rovo Prompt Injection Exfiltrates Jira and Confluence Data Without User Approval.” Cybersecurity News, 2026.

[6] Deviniti. “38 Atlassian AI Statistics for 2026 (Rovo + Atlassian Intelligence Adoption).” Deviniti, 2026.

[7] Cloud Security Alliance. “Indirect Prompt Injection Goes Operational.” Cloud Security Alliance, April 2026.

[8] Cloud Security Alliance. “AI Agent Trust Boundaries: DNS Escape and Exfiltration Flaws.” Cloud Security Alliance, March 2026.

[9] Cloud Security Alliance. “Agent Data Injection: A New Attack Class Beyond Prompt Injection.” Cloud Security Alliance, July 2026.

[10] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, 2026.

[11] Cloud Security Alliance. “Agentic AI Threat Modeling Framework: MAESTRO.” Cloud Security Alliance, February 2025.

[12] PromptArmor. “Atlassian Rovo Exfiltrates Data, Bypassing Controls.” PromptArmor, August 5, 2026.