Attacker-controlled directions could make Atlassian’s Rovo assistant acquire Jira or Confluence knowledge {that a} signed-in person can entry, then ship it to an out of doors server. Two safety companies discovered that habits independently, by completely different routes. Solely a type of routes is confirmed closed.
PromptArmor, an AI safety agency, hid the directions in content material Rovo reads. It mentioned an uploaded file was sufficient to make the assistant collect inside knowledge and ship it out by means of a URL request, with no separate approval step.
The agency printed on August 5, 2026 and mentioned the chain nonetheless labored with Rovo’s web-search possibility switched off. That bypass is single-sourced, and the report establishes the discovering’s standing solely on that date; a later remediation is just not confirmed right here.
Varonis Menace Labs put the directions in a hyperlink as an alternative. It discovered that the rovoChatPrompt URL parameter would preload attacker directions into Rovo Chat, so one click on from an authenticated person was sufficient for Rovo to run them with that person’s privileges and ship the outcomes to an attacker-controlled server.
Varonis calls the flaw RovoBlast and says it disclosed the difficulty by means of Bugcrowd. The Bugcrowd file reveals Atlassian mounted it server-side on July 8, 2026, and the reporter validated the repair.
Neither challenge leaves prospects a patch to use: the hyperlink flaw was closed on Atlassian’s facet, and the lever for the content-borne path is scoping which apps and teams can use Rovo in any respect.
The file that carries orders
The PromptArmor chain is an oblique prompt-injection assault: attacker-controlled textual content is positioned inside content material the assistant is requested to make use of, and the mannequin treats a few of that textual content as directions.
Within the agency’s printed instance, a person uploads a doc carrying a hid injection and asks Rovo to prepare their Jira tickets. Rovo searches Jira and Confluence as requested, appends what it finds to an attacker’s URL and opens it, and the attacker reads the ticket and web page contents out of their very own server logs.
PromptArmor mentioned a person returning to the chat later sees the recommended ticket updates and no signal of the exfiltration.
The interplay is just not cleanly described as zero-click. The sufferer nonetheless has to reveal Rovo to the poisoned content material and make a traditional request. PromptArmor’s narrower declare is that the exfiltration step doesn’t require a separate human-in-the-loop approval.
The net-search discovering issues as a result of Atlassian provides internet search as a separate organization-level setting that lets customers broaden Rovo’s sources to public web sites. PromptArmor mentioned disabling that possibility didn’t cease its chain, as a result of the outbound request used a separate URL-retrieval functionality.
It put the basis trigger plainly: nothing checks whether or not the URL being opened was one the agent constructed itself. The report additionally notes Rovo renders Markdown pictures from mannequin output, a second approach knowledge might depart, although it doesn’t display a full chain by means of that route for Rovo. The net-search bypass stays attributed to PromptArmor quite than handled as independently reproduced.
Atlassian’s web page for that setting doesn’t say whether or not a request the assistant composes and fetches by itself falls underneath the identical management. That’s the query the discovering raises for anybody deciding what the toggle is price.
PromptArmor mentioned it disclosed the difficulty to Atlassian on Might 23, 2026, acquired a case quantity two days later, adopted up on June 4 and once more on July 29, and printed after what it described as no additional communication.
The Hacker Information discovered no post-publication replace to that report as of August 8, 2026, and its textual content nonetheless describes Rovo as weak on the time it went out. That was practically a month after the July 8 repair landed, and neither disclosure says whether or not that change touched the content-borne path.
The one-click hyperlink flaw is mounted
The Bugcrowd disclosure offers the firmer file of the 2, and Varonis has printed a fuller account of the assault.
The rovoChatPrompt parameter might carry a full immediate in a Rovo URL. The proof of idea informed Rovo to find info the sufferer might entry, put it into the trail of an attacker-controlled picture URL and fetch the picture. That request delivered the info to the attacker’s server.
The reporter demonstrated exfiltration of a non-public API key from Confluence, and Bugcrowd says the identical one-click approach was examined in opposition to Jira and knowledge reachable by means of SharePoint and Outlook connectors.
The report is rated P2 on Bugcrowd’s precedence scale and drew a $6,000 bounty; Atlassian deployed the server-side repair on July 8, and the report is marked resolved.
Neither disclosure carries a CVE identifier, and searches of NVD and CISA’s Identified Exploited Vulnerabilities catalog returned none for both challenge as of August 8, 2026.
Permissions, and what could be switched off
Rovo’s knowledge entry follows permissions configured in Atlassian merchandise and related third-party apps. The chance proven is due to this fact knowledge the signed-in sufferer can attain, not a demonstrated tenant-wide authorization bypass.
The demonstrations add a route for permitted knowledge to depart, with the particular person holding these permissions by no means selecting to ship it. That distinction ought to form how the chance is scoped quite than shrink it: in an assistant intentionally wired throughout Atlassian merchandise and related third-party apps, the attain of a single account is the product working as supposed.
Rovo is on by default for apps on Normal, Premium, and Enterprise plans, and everybody in a corporation can use its options, based on Atlassian’s documentation. Directors usually are not restricted to an all-or-nothing selection.
Organizations can block Rovo options for supported apps, which disables present and upcoming AI options for that app, together with Brokers and Chat. Enterprise’s newer entry expertise also can handle Rovo by app and person group.
Atlassian paperwork one caveat: on a web site working a number of Jira-family apps, blocking one among them doesn’t take away the shared capabilities. Rovo Search, Chat and Create with Rovo keep obtainable so long as any Jira app on that web site nonetheless has Rovo enabled.
The hyperlink flaw is already mounted on Atlassian’s facet, so the fast response is narrower than it appears. For the separate content-borne danger, organizations can assessment which apps and teams have Rovo entry, tighten underlying permissions and connector scope, and keep away from treating the web-search toggle by itself as an entire safety boundary.
Neither disclosure experiences proof that both approach has been used in opposition to an actual group. That could be a assertion about what the 2 experiences comprise, not a discovering that no such exercise has occurred.
One path is confirmed closed. PromptArmor mentioned the opposite was unresolved when it printed on August 5; its standing after that date stays unconfirmed.
