Atlassian's Rovo AI assistant has been exposed to two independent attack techniques that could cause it to retrieve Jira and Confluence data accessible to an authenticated user and transmit the information to an attacker-controlled server.
AI security firm PromptArmor and Varonis Threat Labs identified the techniques through different attack paths. Varonis' RovoBlast vulnerability has been fixed by Atlassian, while PromptArmor said its separate content-based attack remained exploitable when it published its findings on August 5, 2026.
Neither finding demonstrated a direct bypass of Jira or Confluence permissions. Instead, both attacks abused the legitimate access available to a victim's Rovo session.
Malicious content can manipulate Rovo
PromptArmor demonstrated an indirect prompt-injection attack in which attacker-controlled instructions were embedded inside content processed by Rovo.
In its example, a user uploaded a malicious document and asked Rovo to organize Jira tickets. The concealed instructions directed the assistant to search Jira and Confluence, collect information available to the user and place the results into an attacker-controlled URL request.
The attacker could then recover the stolen ticket and page contents through server logs.
PromptArmor said the victim would later see the expected ticket suggestions without an obvious indication that information had also been transmitted externally. The attack was not entirely zero-click, as the victim still had to expose Rovo to the malicious content and initiate a normal request. However, the subsequent exfiltration did not require a separate human approval step.
The firm also reported that disabling Rovo's web-search capability did not prevent its demonstrated attack because the exfiltration relied on a separate URL-retrieval capability.
PromptArmor identified the lack of a control preventing Rovo from opening a URL constructed by the model as a root cause. It also noted that Rovo can render Markdown images from model output, which could provide another potential route for data leakage, although the firm did not demonstrate a complete Rovo attack through that mechanism.
PromptArmor said it disclosed the issue to Atlassian on May 23, followed up on June 4 and July 29, and published after reporting no further communication. Its disclosure did not establish whether the content-based attack was remediated after publication.
RovoBlast used a malicious link
Varonis discovered a separate vulnerability involving Rovo's "rovoChatPrompt" URL parameter.
An attacker could place instructions directly into a specially crafted Rovo Chat link. When an authenticated user clicked the link, Rovo would load the attacker-controlled prompt and execute it using the user's existing permissions.
Varonis demonstrated the technique by instructing Rovo to retrieve sensitive information, place it into an attacker-controlled image URL and fetch the resource, thereby sending the data to the attacker.
The researchers successfully exfiltrated a private API key stored in Confluence. They also tested the technique against Jira information and data accessible through SharePoint and Outlook connectors.
The vulnerability, dubbed RovoBlast, was reported through Bugcrowd, received a P2 priority rating and earned a $6,000 bounty. Bugcrowd records Atlassian as deploying a server-side fix on July 8, 2026, after which the researcher validated the remediation and the report was marked resolved.
Enterprise permissions remain central to the risk
Rovo operates across Atlassian products and can incorporate information from connected third-party applications. Atlassian says Rovo access follows the permissions available to the user, meaning the demonstrations did not provide attackers with unrestricted tenant access.
However, the findings expose a different problem: an attacker can attempt to make the AI assistant use a victim's legitimate permissions for an unintended purpose.
Atlassian provides administrators with controls to restrict Rovo by application and, for Enterprise customers, by user group. Rovo is available on Standard, Premium and Enterprise Cloud plans, while disabling Rovo for one Jira-family application may not remove shared Rovo Search, Chat and Create capabilities if another Jira application on the same site still has Rovo enabled.
Neither disclosure reported confirmed exploitation against a real organization, and neither issue has a CVE or entry in CISA's Known Exploited Vulnerabilities catalog as of August 8.
The immediate status is therefore split: Atlassian has confirmed the RovoBlast link vulnerability is closed, while the post-publication status of PromptArmor's separate content-borne attack remains unconfirmed.
Organizations using Rovo should review which applications, user groups and third-party connectors have access, tighten underlying data permissions and avoid treating the web-search setting alone as a complete defense against AI-assisted data exfiltration.
