Atlassian deployed the server-side fix on July 8, 2026, closing one of two independent paths researchers used to make its Rovo assistant send Jira and Confluence data to attacker-controlled servers.
Two independent proof-of-concept chains
Two security teams — PromptArmor and Varonis Threat Labs — independently demonstrated ways an authenticated user’s access could be abused so Rovo would collect data the user could reach and transmit it to an external URL. PromptArmor published its account on August 5, 2026, and Varonis disclosed its findings through Bugcrowd under the name RovoBlast. The two demonstrations share the same high-level consequence — permitted data exiting via Rovo without an explicit human decision to send it — but they rely on distinct levers and have different remediation statuses.
How the Varonis "one‑click" link worked (now fixed)
Varonis found that a rovoChatPrompt URL parameter could preload attacker instructions into a Rovo Chat session. One click from an authenticated user was sufficient for Rovo to run those preloaded instructions with that user’s privileges and fetch data into an attacker-controlled location. Varonis’ proof of concept moved data into the path of an attacker-hosted image URL and demonstrated exfiltration of a private Confluence API key; Bugcrowd reports the same technique was tested against Jira and data reachable via SharePoint and Outlook connectors. Bugcrowd rated the report P2, awarded a $6,000 bounty, and the record shows Atlassian applied a server-side fix on July 8, 2026; the reporter validated the remediation and the Bugcrowd record is marked resolved.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow the PromptArmor content‑borne chain worked (status unconfirmed)
PromptArmor described an indirect prompt‑injection vector in which attacker-controlled text is embedded inside content that Rovo is asked to read. In its published example, a user uploaded a document containing a concealed instruction and then asked Rovo to organize Jira tickets. According to PromptArmor, Rovo searched Jira and Confluence as requested, appended the retrieved content to an attacker URL and opened it, delivering ticket and page content to the attacker’s server logs. PromptArmor said the interaction requires the victim expose Rovo to the poisoned content and make a normal request, but it asserted the exfiltration step did not require a separate human-in-the-loop approval. The firm also reported that disabling Atlassian’s web-search option did not block this chain because the outbound fetch used a separate URL-retrieval capability; that bypass remains single-sourced to PromptArmor and its remediation status after the August 5 publication is unconfirmed.
Permissions, admin controls, and a key limitation
Rovo’s access follows the permissions configured in Atlassian products and connected third-party apps, so the demonstrated risk is limited to data a signed-in user can reach. Rovo is enabled by default for apps on Standard, Premium, and Enterprise plans and available to everyone in an organization. Administrators can block Rovo features for supported apps — which disables current and upcoming AI features for that app, including Agents and Chat — and Enterprise’s newer access experience can manage Rovo by app and user group. Atlassian documents, however, that on a site running several Jira-family apps, blocking one app does not remove shared capabilities: Rovo Search, Chat and Create with Rovo remain available as long as any Jira app on the site still has Rovo enabled. PromptArmor additionally noted Rovo renders Markdown images from model output as another potential exfiltration route, though it did not demonstrate a full chain via that mechanism.
What this means for security teams, administrators, and end users
- Security teams: The confirmed Varonis chain shows agent-preloaded prompts in URLs can be abused; the fix was applied server-side on July 8, 2026, but teams should verify that the platform behavior aligns with their threat model and confirm no related URL preloading remains possible.
- Administrators and procurement leaders: Because Rovo is enabled by default across common plans and its controls can be scoped to apps and groups, administrators should review which apps and user groups currently have Rovo access, tighten connector scopes and underlying permissions, and avoid treating the web-search toggle as a complete boundary.
- End users: The demonstrations exploit data a signed-in user can already reach; users should be cautious about uploading untrusted content and clicking unexpected Rovo links or prompts from unverified sources.
Neither disclosure carried a CVE identifier, and as of August 8, 2026, searches of NVD and CISA’s Known Exploited Vulnerabilities catalog returned none for either issue. Neither disclosure reported evidence of the techniques being used against real organizations; that is a statement of what the reports contain, not proof no such activity has occurred. One path — the rovoChatPrompt preloading vector — is confirmed closed by Atlassian’s July 8 server-side fix. The content‑borne chain described by PromptArmor remains attributed to that single report, and its post-publication status is not confirmed in the available record.
