Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers

What it is

Two independent prompt-injection routes let Atlassian Rovo exfiltrate any Jira/Confluence data the signed-in user can reach. The summary names both (PromptArmor's file-borne injection, Varonis's rovoChatPrompt "RovoBlast"). What it omits is the root cause, why the web-search toggle is not a boundary, and the configuration levers that actually apply.

How it works (the part that scopes your response)

PromptArmor's root cause, stated plainly: nothing checks whether the URL Rovo opens was one the agent constructed itself. Disabling web search — an org-level setting that expands Rovo to public sites — did not stop the chain, because exfiltration used a separate URL-retrieval capability, not web search. So the toggle is not a security boundary for this. A second potential channel: Rovo renders Markdown images from model output (not demonstrated end-to-end for Rovo, but noted).

RovoBlast's scope is broader than the summary implies: Bugcrowd records the same one-click technique tested against Jira, and data reachable through SharePoint and Outlook connectors — not just Confluence.

Preconditions / Affected

• Rovo is on by default for apps on Standard, Premium, and Enterprise plans, and everyone in the org can use it.
• Risk is bounded by the victim's own permissions across Atlassian products and connected third-party apps — not a tenant-wide auth bypass. In a cross-product assistant, a single account's reach is the product working as intended.

What to do

The link flaw is already fixed server-side (July 8, 2026); no customer patch. For the still-unconfirmed content-borne path:

• Block Rovo features per app (disables current/upcoming AI features including Agents and Chat). Enterprise's newer access experience can manage Rovo by app and user group — not all-or-nothing.
• Tighten underlying permissions and connector scope — this is the real lever, since Rovo inherits the user's access.
• Do not treat the web-search toggle as a complete boundary — it does not cover agent-composed URL fetches.

Caveat on blocking: on a site running several Jira-family apps, blocking one does not remove shared capabilities. Rovo Search, Chat, and Create with Rovo stay available as long as any Jira app on that site still has Rovo enabled.

Caveats

• The web-search bypass is single-sourced to PromptArmor, not independently reproduced. Neither disclosure says whether the July 8 fix touched the content-borne path; its status after PromptArmor's Aug 5 publication is unconfirmed.
• No CVE for either issue in NVD or CISA KEV as of Aug 8, 2026. Neither report shows real-world exploitation — a statement about the reports' contents, not evidence of none.