Critical Prompt Injection in Atlassian Rovo Exfiltrates Jira, Confluence Data

Key Takeaways

• A critical prompt injection vulnerability, dubbed “RovoBlast,” was discovered in Atlassian Rovo, the company’s enterprise AI assistant.
• The flaw allowed attackers to exfiltrate sensitive data from Jira, Confluence, and other connected services by tricking authenticated users into clicking a malicious link.
• The vulnerability leveraged parameter-to-prompt (P2P) injection, enabling the AI assistant to process attacker-controlled instructions within the victim’s session.
• Atlassian has issued a server-side fix, deployed on July 8, 2026, addressing the URL-based issue.

A significant prompt injection vulnerability, named “RovoBlast,” has been identified in Atlassian Rovo, the AI assistant designed for enterprise use. This flaw could enable malicious actors to extract sensitive corporate data from various connected services, including Jira, Confluence, and SharePoint, through a single user click.

Atlassian has confirmed that it addressed the underlying URL-based issue through a server-side fix, which was implemented on July 8, 2026, following a responsible disclosure process.

Atlassian Rovo serves as an AI-powered assistant for businesses, offering capabilities to search, summarize, and execute actions across platforms like Jira, Confluence, Bitbucket, and various third-party SaaS applications. Its strength lies in its extensive access to organizational context; however, this broad access also introduces potential security vulnerabilities when external, untrusted content is interpreted as legitimate instructions.

Understanding the RovoBlast Attack

The RovoBlast attack exploited a specific URL parameter, rovoChatPrompt. This parameter allowed an attacker to pre-populate Rovo Chat with a malicious prompt when a legitimate, signed-in user clicked on a specially crafted link.

According to Varonis, whose researchers discovered and reported the flaw, the AI assistant would process the injected text within the victim’s authenticated session. This effectively granted the attacker the same contextual understanding and access privileges that the legitimate user possessed.

Crucially, this attack did not necessitate a “jailbreak” of the AI model, the theft of user credentials, or any direct bypass of existing permissions. Instead, it relied on a technique known as parameter-to-prompt (P2P) injection. The victim merely needed to click a malicious link while actively logged into their Atlassian account. Once triggered, Rovo could then search data sources accessible to the victim and summarize the findings, potentially exposing confidential information.

It is important to note that RovoBlast did not grant an attacker unfettered access to an entire Atlassian tenant. The scope of exfiltrated data was limited by the specific permissions of the signed-in user whose session was compromised. Nevertheless, many employees hold access to critical information such as confidential Jira tickets, internal Confluence pages, API keys, strategic project plans, customer records, and incident response documentation. Consequently, compromising even a single user’s session could lead to the exposure of highly valuable business intelligence.

Enhanced Impact from Rovo’s Autonomous Features

Varonis researchers highlighted that Rovo’s autonomous capabilities significantly amplified the potential impact of this vulnerability. Rovo’s “ResearchAgent,” for instance, can undertake complex, multi-step research and browsing tasks. In a scenario involving an unsafe prompt injection, such features could enable the AI assistant to retrieve internal content, transform it into a different format, and then transmit it to an external destination with minimal additional user interaction.

This discovery underscores a broader security challenge emerging with enterprise AI adoption. AI assistants increasingly combine access to private organizational data, exposure to potentially untrusted external content, and the ability to interact with external tools or websites. This convergence of capabilities means that even seemingly innocuous elements like a link, document, comment, or connected application can become an entry point for instruction injection, leading to unintended data exposure or manipulation.

What You Should Do

• Review Rovo Permissions: Treat AI assistants like Atlassian Rovo as privileged access layers, not just simple chat interfaces. Regularly review and restrict Rovo’s permissions to only what is strictly necessary for operational tasks.
• Disconnect Unused Connectors: Audit and disconnect any unused connectors to third-party services or internal repositories within Rovo to minimize the attack surface.
• Restrict Access to Sensitive Data: Limit Rovo’s access to highly sensitive repositories, such as those containing legal, HR, finance, or security incident records, unless absolutely essential.
• Limit Agentic Capabilities: Where not operationally required, restrict or disable Rovo’s agentic browsing and automation capabilities to mitigate the risk of autonomous data exfiltration.
• Monitor AI Activity Logs: Implement and regularly review AI activity logs for unusual agent runs or suspicious interactions. Investigate any instances where external inputs appear to influence AI behavior in an unexpected manner.
• Conduct User Awareness Training: Educate employees on the dangers of malicious links and AI-enabled phishing scenarios, emphasizing the importance of vigilance when interacting with AI assistants and external content.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.