Full Report
Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor, an AI security firm, hid the instructions in content Rovo reads. It said an uploaded file was
Analysis Summary
# Vulnerability: RovoBlast and Indirect Prompt Injection in Atlassian Rovo
## CVE Details
- **CVE ID**: Not explicitly assigned in the report (Referenced via Bugcrowd disclosure bf1922fb-99d0-4d3b-b419-1728720d29ec).
- **CVSS Score**: Not provided (High/Critical potential due to automated data exfiltration).
- **CWE**: CWE-506 (Embedded Malicious Code / Indirect Prompt Injection).
## Affected Systems
- **Products**: Atlassian Rovo (AI assistant for Jira and Confluence).
- **Versions**: Cloud-based services active prior to July 8, 2026.
- **Configurations**: Systems with Rovo enabled; specifically those where "web-search" or URL-retrieval capabilities are active.
## Vulnerability Description
Two distinct attack vectors allow for the unauthorized exfiltration of sensitive enterprise data:
1. **Indirect Prompt Injection (PromptArmor)**: An attacker hides malicious instructions within a document (e.g., a Jira ticket or Confluence page). When a user asks Rovo to process this content, the AI interprets the hidden text as instructions to gather internal data and append it to an attacker-controlled URL via Rovo's URL-retrieval capability.
2. **URL Parameter Injection (RovoBlast)**: The `rovoChatPrompt` URL parameter was found to preload attacker instructions into Rovo Chat. If an authenticated user clicks a crafted link, Rovo executes the prompt using the user's permissions to locate and exfiltrate data.
## Exploitation
- **Status**: PoC available; identified by PromptArmor and Varonis Threat Labs.
- **Complexity**: Low (requires crafting a document or a malicious URL).
- **Attack Vector**: Network / Remote. Exploitation requires minimal user interaction (opening a document or clicking a link).
## Impact
- **Confidentiality**: High (Full access to any Jira/Confluence data the victim can view).
- **Integrity**: Medium (Potential for the AI to suggest malicious "updates" to tickets).
- **Availability**: Low (No direct system denial of service reported).
## Remediation
### Patches
- **Server-side Fix**: Atlassian implemented a server-side fix for the `rovoChatPrompt` (RovoBlast) vulnerability on **July 8, 2026**.
- **Content-borne Injection**: No specific patch was confirmed for the indirect injection via uploaded files as of August 8, 2026.
### Workarounds
- **Access Control**: Restrict which user groups and applications have permission to use Rovo.
- **Feature Disabling**: While PromptArmor noted that disabling "web-search" did not stop their specific chain, limiting Rovo’s scope of data access reduces the potential impact.
## Detection
- **Indicators of Compromise**:
- Unusual outbound requests in server logs to unknown external domains, particularly those containing strings that look like Jira/Confluence metadata.
- Presence of the `rovoChatPrompt` parameter in web proxy/gateway logs pointing to Atlassian domains.
- **Detection Methods**: Monitor for Rovo's URL-retrieval patterns and inspect internal documents for hidden or "invisible" text blocks that may contain instructions for LLMs.
## References
- **Vendor Advisory**: hxxps://support[.]atlassian[.]com/organization-administration/docs/manage-a-web-search-option-for-rovo/
- **Bugcrowd Disclosure**: hxxps://bugcrowd[.]com/disclosures/bf1922fb-99d0-4d3b-b419-1728720d29ec/one-click-data-exfiltration-via-rovochatprompt-url-parameter-confluence-rovo
- **Varonis Research**: hxxps://www[.]varonis[.]com/blog/rovoblast
- **PromptArmor Report**: Published August 5, 2026 (Referenced in article).