RovoBlast: Atlassian Rovo Prompt Injection Leaks Jira Data

Atlassian's Rovo AI assistant can be steered into leaking Jira tickets and Confluence pages to an attacker-controlled server. Two security firms found the problem separately in August 2026. One path, a one-click link flaw called RovoBlast, is already fixed on Atlassian's side. The other, an indirect rovo prompt injection hidden inside uploaded documents, was still open when reported. This article breaks down both attack chains and what engineering teams should do about them.

What Is RovoBlast

RovoBlast is the name Varonis Threat Labs gave to a flaw in Atlassian Rovo, the AI teammate layer that sits across Jira, Confluence, Bitbucket and connected SaaS apps. Rovo accepts an externally supplied prompt through the rovoChatPrompt URL parameter. A crafted link such as home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt=<prompt> injects attacker text directly into the chat entry of a signed-in user. One click runs those instructions with the user's privileges, with no warning, confirmation or taint label. The organization ID can even be left empty and Atlassian redirects to the user's default organization.

The same week, PromptArmor published a second, independent chain built on indirect prompt injection. Here the attacker hides instructions inside a document. A user uploads that file to Rovo, asks it to organize their Jira tickets, and the injected text tells the assistant to append ticket and page contents to an attacker URL and fetch it. The exfiltration step needs no separate approval.

The Two Attack Paths at a Glance

Detail	Varonis RovoBlast	PromptArmor chain
Vector	rovoChatPrompt URL parameter	Hidden injection in uploaded file
Interaction	One click on a crafted link	Normal upload plus a normal query
Data exit	Image URL fetch and ResearchAgent	Rovo URL retrieval tool
Status	Fixed server side July 8, 2026	Unresolved as of August 5 report
Disclosure	Bugcrowd, P2, 6,000 USD bounty	Direct to Atlassian, no fix confirmed

How the One-Click Chain Works

The rovoChatPrompt parameter is a parameter-to-prompt pathway. Varonis first demonstrated the pattern with Reprompt against Microsoft Copilot in January 2026; RovoBlast shows the same primitive inside Atlassian's stack. Because the prompt is prefilled before the page loads, the session becomes seeded before the victim clicks anything else.

The critical step is the exfiltration primitive. Rovo's ResearchAgent tool supports deep multi-source open web research and multi-step browsing and navigation across arbitrary websites. That turns fetch, transform, upload into one autonomous sequence. In the proof of concept, Rovo located information the victim could access, put it into the path of an attacker-controlled image URL and fetched the image, delivering the data to the attacker's server. Varonis demonstrated exfiltration of a private API key from Confluence, and the same technique was reproduced against Jira and data reachable through SharePoint and Outlook connectors.

The PromptArmor variant uses a different tool for the same outcome. Rovo's URL retrieval tool has no protection against opening a URL that the agent itself constructed. The injected text makes the assistant append sensitive data to the attacker's URL; when the tool opens it, the attacker's server logs the request, including the appended data. PromptArmor notes this works even when an organization toggled off Rovo's web search setting, because that setting does not remove the URL-opening tool. A second exfiltration path exists through Rovo's rendering of Markdown images from model output.

Why This Matters for Engineering Teams

Rovo ships as an always-on component of Atlassian Cloud plans. It is enabled by default on Standard, Premium and Enterprise, and Atlassian documentation says Rovo cannot be fully uninstalled. Worse for defenders, Rovo is a federated data layer: it reads Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, relational databases, uploaded files and web pages through more than 50 connectors. An attacker who seeds one prompt gets read access to whatever the signed-in victim can reach.

None of this is a permission bypass. The assistant acts within the victim's existing access. That is exactly why it is dangerous: legitimate identity, legitimate tools, legitimate audit trail. Simon Willison's lethal trifecta for AI agents applies here, private data access plus untrusted content exposure plus the ability to communicate externally. RovoBlast fits the model, and Varonis argues that blocking one exit, such as direct internet access, does not stop data from leaving through trusted services.

Mitigation and Hardening

Neither disclosure carries a CVE identifier, and neither technique had been observed against a real organization at the time of writing. The fix status differs by path.

• The rovoChatPrompt flaw is closed: Atlassian deployed a server-side fix on July 8, 2026, and the reporter validated it. There is no customer patch to apply.
• The content-borne injection path was still open when PromptArmor published on August 5. Its status after that date is not confirmed by any later update.

What teams can do now:

1. Limit which apps and user groups can use Rovo. Atlassian documents blocking Rovo features per app, and the Enterprise access experience manages Rovo by app and user group. Note the caveat: blocking one Jira-family app does not remove shared capabilities while any Jira app on the site still has Rovo enabled.
2. Shrink the data surface. Disconnect unused connectors and keep high sensitivity areas such as legal, HR, finance and incident response out of reach entirely.
3. Disable capabilities you do not use, including browsing agents and multi-step automation.
4. Watch the outbound path. Review assistant logs, alert on unusual agent runs and on requests to unexpected domains, and periodically check how your environment reacts to seeded prompts.
5. Do not treat the web search toggle as a security boundary. PromptArmor demonstrated the chain running with it disabled.

Frequently Asked Questions

Q: Is RovoBlast a CVE? No. Neither the Varonis nor the PromptArmor disclosure received a CVE identifier, and searches of NVD and CISA KEV returned nothing as of August 8, 2026.

Q: Do I need to patch anything? Atlassian fixed the one-click rovoChatPrompt path server side on July 8. There is no on-premise component and no client patch. Re-evaluate Rovo permissions instead.

Q: Does the attack work through any file, or only documents? The mechanism is content-borne: any content Rovo reads can carry instructions, including support tickets, connected app data and web data when search is enabled. The published example used an uploaded document.

Q: Can Rovo be turned off entirely? Rovo cannot be fully uninstalled. Atlassian offers per-app blocking and, on Enterprise, app and user-group based access management.

Q: Was this exploited in the wild? Neither firm reports evidence of real-world use.

Key Takeaways

• Two independent findings, two different exfiltration tools, one root pattern: attacker text becomes assistant instructions.
• The RovoBlast link path is fixed server side; the document-borne path was still open when reported.
• Rovo's federated access plus autonomous agent tools multiplies the blast radius of any single prompt injection.
• No CVE exists, so scanners and KEV feeds will not catch this risk. Review Rovo configuration manually.

---

Sources: Varonis RovoBlast write-up | PromptArmor report | The Hacker News coverage