Rovo can send Jira and Confluence data to attackers

What this is about

Security researchers have documented two separate ways in which Atlassian Rovo could send data from Jira and Confluence to an external server. Varonis published the one-click attack it calls RovoBlast on August 7, 2026. PromptArmor had described a different route on August 5, using hidden instructions inside uploaded or connected content.

The distinction matters: Atlassian closed the link-based issue reported by Varonis on the server side on July 8. PromptArmor, however, said its content-based attack still worked when published. There is no later confirmation from Atlassian or independent reproduction for that claim. There is also no evidence that either route has been abused against a real organization.

What Rovo actually does

Rovo searches information that a signed-in user is allowed to access across Atlassian products and connected services. That useful reach is exactly what becomes risky. In RovoBlast, a crafted URL placed instructions into the rovoChatPrompt parameter. When a signed-in user opened the link, Rovo loaded the instruction into a trusted session, searched information available to the user, and called an attacker-controlled address. Data could be embedded in that URL.

PromptArmor used a different entry point: a document or external item contained a hidden prompt injection. Rovo might be asked to organize Jira tickets, read the foreign instruction while doing so, and transmit discovered content through its URL-opening tool. PromptArmor said this worked even when the organization had disabled web search. The company attributes that result to the separate ability to open a URL remaining available.

Why it matters

Based on the published evidence, the attack does not bypass permissions between tenants. It uses the victim's existing permissions. That can still be serious for a business: an employee may see project details, customer tickets, or internal vulnerabilities in Jira, plus strategy documents, minutes, or technical documentation in Confluence. Rovo is intentionally designed to connect these sources; a manipulated instruction can use that reach for exfiltration.

The Bugcrowd record rates RovoBlast as P2, lists a $6,000 bounty, and marks the issue resolved. The content-based attack described by PromptArmor is less settled. Its report lists May 23 as the disclosure date and August 5 as the publication date, after what the researchers describe as a lack of further communication. Organizations therefore should not infer from one fixed path that every form of indirect prompt injection has been eliminated.

In plain language

Think of Rovo as an assistant carrying a ring of keys. It can only open rooms for which the employee already has a key. A crafted note, however, can trick the assistant into copying documents from those rooms and sending them to a stranger. The lock works correctly; the problem is that the assistant treats a foreign request as a genuine work instruction.

A practical example

A project manager is allowed to read 250 Jira tickets and 40 Confluence pages for a customer project. She uploads what looks like a project guide and asks Rovo to summarize ten overdue tasks. The document contains a concealed instruction to append discovered content to attacker.example.

If the reported content-based attack works, Rovo cannot suddenly read every document in the company. It can, however, process tickets and pages within the project manager's permission scope and transfer excerpts through an outbound request. This is why limited permissions and narrowly scoped connections matter: they reduce the potential damage even when the prompt injection itself is not reliably detected.

Scope and limits

• The one-click route through rovoChatPrompt was fixed on the server side according to Bugcrowd and validated by the researchers. Customers do not have a local patch to install.
• The status of the separate content-based route rests on PromptArmor's August 5 report. There is no current statement from Atlassian and no independent confirmation.
• The reports demonstrate potential exfiltration within a signed-in user's permission scope, not a tenant-wide authorization bypass or a known attack in the wild.

Administrators can restrict Rovo for supported apps or user groups, review underlying permissions, and narrow connector access to what is necessary. PromptArmor's report means disabling web search alone should not be treated as a complete security boundary.

SEO & GEO keywords

Atlassian Rovo, RovoBlast, Jira, Confluence, prompt injection, data exfiltration, Varonis Threat Labs, PromptArmor, Bugcrowd, AI security