Researchers Warn Atlassian Rovo Could Be Used to Exfiltrate Jira and Confluence Data

Security researchers have identified two attack paths that could cause Atlassian’s Rovo AI assistant to send data accessible to a signed-in user to an attacker-controlled server. The findings were reported independently by PromptArmor and Varonis Threat Labs, but their remediation status differs.

Poisoned content and outbound requests

PromptArmor described an indirect prompt-injection technique in which malicious instructions are embedded in a document or other content that Rovo processes. In its demonstration, a user uploaded a booby-trapped file and asked Rovo to organize Jira tickets. The assistant then searched Jira and Confluence, incorporated the results into a URL, and requested that URL, allowing the attacker to recover the information through server logs.

The scenario still requires a user to provide the poisoned content and initiate a normal Rovo task. However, PromptArmor said the data transfer did not require a separate approval prompt. The firm also reported that disabling Rovo’s web-search feature did not prevent the behavior, because the relevant outbound request used a different retrieval capability. That aspect has not been independently reproduced, and the status of the content-based issue after PromptArmor’s August 5, 2026 publication is unclear.

RovoBlast link attack was fixed

Varonis reported a separate issue, dubbed RovoBlast, involving the rovoChatPrompt URL parameter. An attacker could place instructions in a specially crafted link. When an authenticated user clicked it, Rovo Chat would process the prompt with that user’s permissions and send selected results to an attacker-controlled image URL.

The proof of concept reportedly extracted a private Confluence API key, and testing also covered information available through Jira, SharePoint, and Outlook connectors. Atlassian fixed the issue server-side on July 8, 2026, according to the Bugcrowd disclosure, and Varonis validated the correction. The report received a $6,000 bounty and was marked resolved.

Permissions remain central

Neither report demonstrated a bypass of Atlassian authorization. The exposed information was limited to data the victim could already access, although the techniques created an unintended route for that data to leave the organization. Neither disclosure reported evidence of real-world exploitation, and no CVE or Known Exploited Vulnerabilities listing was identified for either issue.

Administrators can reduce exposure by limiting Rovo access by application and user group, reviewing connector permissions, and tightening underlying Jira, Confluence, and third-party access controls. Atlassian’s web-search setting should not be treated as the sole boundary for preventing agent-generated outbound requests.