Atlassian Rovo Flaws Could Exfiltrate Jira and Confluence Data to Attackers

Two security firms have independently discovered that Atlassian’s Rovo AI assistant can be tricked into sending sensitive Jira and Confluence data to attacker-controlled servers. The flaws, disclosed in August 2026, highlight the risks of prompt injection in enterprise AI tools.

PromptArmor, an AI security firm, demonstrated an indirect prompt injection attack where attacker-controlled instructions hidden in uploaded content could make Rovo collect internal data and exfiltrate it via a URL request, without requiring separate user approval. The attack worked even with Rovo’s web-search option disabled, as the outbound request used a separate URL-retrieval capability. PromptArmor disclosed the issue to Atlassian on May 23, 2026, but published its findings on August 5, 2026, after receiving no further communication.

Varonis Threat Labs, another security firm, found a separate flaw in the rovoChatPrompt URL parameter, which could preload attacker instructions into Rovo Chat. A single click from an authenticated user would execute the instructions with the user’s privileges and send data to an attacker’s server. Varonis named this flaw ‘RovoBlast’ and disclosed it through Bugcrowd. Atlassian fixed this server-side on July 8, 2026, and the reporter validated the fix. The bug was rated P2 on Bugcrowd’s priority scale and earned a $6,000 bounty.

Neither issue has a CVE identifier, and no evidence suggests either technique has been used against real organizations. The link-based flaw is confirmed fixed, while the content-borne path remains unconfirmed as of August 8, 2026. Organizations using Rovo are advised to review which apps and groups have access, tighten permissions and connector scope, and not rely solely on the web-search toggle as a security boundary.