Attacker-controlled directions could make Atlassian’s Rovo assistant acquire Jira or Confluence knowledge {that a} signed-in consumer can entry, then ship it to an outdoor server. Two safety corporations discovered that habits independently, by completely different routes. Solely a kind of routes is confirmed closed.
PromptArmor, an AI safety agency, hid the directions in content material Rovo reads. It mentioned an uploaded file was sufficient to make the assistant collect inner knowledge and ship it out by way of a URL request, with no separate approval step.
The agency revealed on August 5, 2026 and mentioned the chain nonetheless labored with Rovo’s web-search possibility switched off. That bypass is single-sourced, and the report establishes the discovering’s standing solely on that date; a later remediation just isn’t confirmed right here.
Varonis Risk Labs put the directions in a hyperlink as an alternative. It discovered that the rovoChatPrompt URL parameter would preload attacker directions into Rovo Chat, so one click on from an authenticated consumer was sufficient for Rovo to run them with that consumer’s privileges and ship the outcomes to an attacker-controlled server.
Varonis calls the flaw RovoBlast and says it disclosed the problem by way of Bugcrowd. The Bugcrowd document exhibits Atlassian mounted it server-side on July 8, 2026, and the reporter validated the repair.
Neither subject leaves prospects a patch to use: the hyperlink flaw was closed on Atlassian’s facet, and the lever for the content-borne path is scoping which apps and teams can use Rovo in any respect.
The file that carries orders
The PromptArmor chain is an oblique prompt-injection assault: attacker-controlled textual content is positioned inside content material the assistant is requested to make use of, and the mannequin treats a few of that textual content as directions.
Within the agency’s revealed instance, a consumer uploads a doc carrying a hid injection and asks Rovo to arrange their Jira tickets. Rovo searches Jira and Confluence as requested, appends what it finds to an attacker’s URL and opens it, and the attacker reads the ticket and web page contents out of their very own server logs.
PromptArmor mentioned a consumer returning to the chat later sees the prompt ticket updates and no signal of the exfiltration.
The interplay just isn’t cleanly described as zero-click. The sufferer nonetheless has to reveal Rovo to the poisoned content material and make a traditional request. PromptArmor’s narrower declare is that the exfiltration step doesn’t require a separate human-in-the-loop approval.
The online-search discovering issues as a result of Atlassian presents net search as a separate organization-level setting that lets customers develop Rovo’s sources to public web sites. PromptArmor mentioned disabling that possibility didn’t cease its chain, as a result of the outbound request used a separate URL-retrieval functionality.
It put the foundation trigger plainly: nothing checks whether or not the URL being opened was one the agent constructed itself. The report additionally notes Rovo renders Markdown photos from mannequin output, a second method knowledge may go away, although it doesn’t display a full chain by way of that route for Rovo. The online-search bypass stays attributed to PromptArmor fairly than handled as independently reproduced.
Atlassian’s web page for that setting doesn’t say whether or not a request the assistant composes and fetches by itself falls underneath the identical management. That’s the query the discovering raises for anybody deciding what the toggle is value.
PromptArmor mentioned it disclosed the problem to Atlassian on Could 23, 2026, obtained a case quantity two days later, adopted up on June 4 and once more on July 29, and revealed after what it described as no additional communication.
The Hacker Information discovered no post-publication replace to that report as of August 8, 2026, and its textual content nonetheless describes Rovo as susceptible on the time it went out. That was practically a month after the July 8 repair landed, and neither disclosure says whether or not that change touched the content-borne path.
The one-click hyperlink flaw is mounted
The Bugcrowd disclosure offers the firmer document of the 2, and Varonis has revealed a fuller account of the assault.
The rovoChatPrompt parameter may carry a full immediate in a Rovo URL. The proof of idea advised Rovo to find info the sufferer may entry, put it into the trail of an attacker-controlled picture URL and fetch the picture. That request delivered the information to the attacker’s server.
The reporter demonstrated exfiltration of a non-public API key from Confluence, and Bugcrowd says the identical one-click approach was examined towards Jira and knowledge reachable by way of SharePoint and Outlook connectors.
The report is rated P2 on Bugcrowd’s precedence scale and drew a $6,000 bounty; Atlassian deployed the server-side repair on July 8, and the report is marked resolved.
Neither disclosure carries a CVE identifier, and searches of NVD and CISA’s Recognized Exploited Vulnerabilities catalog returned none for both subject as of August 8, 2026.
Permissions, and what will be switched off
Rovo’s knowledge entry follows permissions configured in Atlassian merchandise and linked third-party apps. The chance proven is due to this fact knowledge the signed-in sufferer can attain, not a demonstrated tenant-wide authorization bypass.
The demonstrations add a route for permitted knowledge to go away, with the particular person holding these permissions by no means selecting to ship it. That distinction ought to form how the chance is scoped fairly than shrink it: in an assistant intentionally wired throughout Atlassian merchandise and linked third-party apps, the attain of a single account is the product working as meant.
Rovo is on by default for apps on Customary, Premium, and Enterprise plans, and everybody in a corporation can use its options, in accordance with Atlassian’s documentation. Directors usually are not restricted to an all-or-nothing alternative.
Organizations can block Rovo options for supported apps, which disables present and upcoming AI options for that app, together with Brokers and Chat. Enterprise’s newer entry expertise also can handle Rovo by app and consumer group.
Atlassian paperwork one caveat: on a web site operating a number of Jira-family apps, blocking one in all them doesn’t take away the shared capabilities. Rovo Search, Chat and Create with Rovo keep obtainable so long as any Jira app on that web site nonetheless has Rovo enabled.
The hyperlink flaw is already mounted on Atlassian’s facet, so the rapid response is narrower than it seems to be. For the separate content-borne danger, organizations can evaluate which apps and teams have Rovo entry, tighten underlying permissions and connector scope, and keep away from treating the web-search toggle by itself as a whole safety boundary.
Neither disclosure experiences proof that both approach has been used towards an actual group. That may be a assertion about what the 2 experiences include, not a discovering that no such exercise has occurred.
One path is confirmed closed. PromptArmor mentioned the opposite was unresolved when it revealed on August 5; its standing after that date stays unconfirmed.
