Atlassian Rovo Prompt Injection Sends Jira and Confluence Data to Attackers, One Path Still Unfixed

August 8, 2026. Two independent security firms — PromptArmor and Varonis Threat Labs — publish simultaneous proof-of-concept attacks showing that Rovo, Atlassian’s AI assistant embedded in Jira and Confluence, can be manipulated through prompt injection to gather internal data and send it to an attacker-controlled server. One attack path was closed server-side on July 8, 2026 — the other remained open on August 8, with no fix communicated.

The problem for organisations using Atlassian Cloud is structural: Rovo is enabled by default on Standard, Premium, and Enterprise plans. The assistant accesses, with the signed-in user’s permissions, every Jira and Confluence space that user can see. Both attacks demonstrate that this access can be hijacked without exploiting a classic software vulnerability — purely by manipulating the underlying language model.

Two vectors, one result

The two teams took different paths to reach the same outcome: Jira and Confluence data exfiltration through indirect prompt injection.

Varonis — the URL vector (fixed). Varonis Threat Labs discovered that the rovoChatPrompt URL parameter can preload instructions into a Rovo chat session. An attacker crafts a URL targeting a Confluence or Jira instance which, when clicked by an authenticated user, loads a malicious prompt into Rovo. The prompt instructs the assistant to search for information the user can access, embed it into the path of an image hosted on an attacker-controlled server, and open that image — leaking the data through the attacker’s web server logs.

The Varonis demonstration exfiltrated a private API key from Confluence. The team also validated the same technique against Jira and SharePoint and Outlook connectors. The flaw, dubbed RovoBlast, was submitted through Bugcrowd, rated P2, and earned a $6,000 bounty. Atlassian deployed a server-side fix on July 8, 2026 — no client-side patch was required.

PromptArmor — the document vector (unfixed). The second attack, documented by PromptArmor and published on August 5, 2026, follows a different path. The attacker uploads a document (text file, PDF, Confluence page) containing hidden instructions inside content that Rovo is asked to read. When the victim asks Rovo to organise their Jira tickets, the assistant reads the poisoned document, executes the hidden instructions, searches through the accessible Jira and Confluence data, and sends the results to an attacker-controlled URL.

PromptArmor highlights two critical details: the exfiltration requires no separate human-in-the-loop approval step, and disabling Rovo’s web-search toggle does not block the attack. The firm disclosed the issue to Atlassian on May 23, 2026, received an acknowledgement on May 25, followed up on June 4 and again on July 29. As of August 8, 2026, PromptArmor’s report still described Rovo as vulnerable.

Why the server-side fix is not enough

Atlassian closing the URL vector on July 8 is welcome — it cuts off an attack path that required only a single click. But leaving the document vector unfixed a month after public disclosure is a dangerous gamble.

The PromptArmor report has been public since August 5, 2026. The technical details are precise enough to reproduce: the injection prompt is documented, the poisoning scenario is described, and the claim that the web-search toggle does not block the attack is verifiable. Any competent threat actor can reproduce the attack within hours.

The risk is compounded by Rovo’s default exposure. According to Atlassian’s documentation, Rovo is enabled for all supported apps on Standard, Premium, and Enterprise plans. The assistant can see everything the signed-in user can access — which, in a typical organisation, covers most of the Jira and Confluence perimeter.

The only effective client-side barrier is fine-grained access control: restricting which apps and user groups can use Rovo. Atlassian documents this capability in its admin portal, with an important caveat: on a site running multiple Jira-family apps, blocking one does not remove the shared capabilities. Rovo Search, Chat, and Create with Rovo remain available as long as at least one Jira app on that site keeps them enabled.

What admins can do today

Without a formal fix for the document vector — and no CVE assigned as of August 8 — Atlassian Cloud administrators have no patch to apply. They do, however, have a set of risk-reduction measures at their disposal.

1. Audit Rovo access. Check the Atlassian admin portal to see which apps and user groups have Rovo features enabled. The official documentation describes how to block Rovo per app and per user group.

2. Disable Rovo on sensitive apps. If your Confluence instance contains restricted-access spaces (finance, security, HR), consider turning off Rovo for those apps until a confirmed fix arrives.

3. Tighten underlying permissions. The PromptArmor attack operates within the victim’s permission boundaries. Tightening permissions — applying least privilege — mechanically reduces the volume of exfiltratable data.

4. Monitor outbound request logs. The exfiltration relies on an HTTP request to an external server. Your proxy or outbound firewall logs may reveal calls to unusual domains originating from your Atlassian Cloud instance’s IP range.

5. Train users on unsolicited files. The document vector depends on uploading a poisoned file. Educate your teams not to interact with files from unknown sources inside a Rovo context.

Verdict

Atlassian Rovo is a powerful AI assistant deeply integrated into the Atlassian Cloud ecosystem — and that is precisely what makes it dangerous. The two prompt injection attacks demonstrate that AI assistants wired to real enterprise data represent a genuinely new attack surface, still poorly covered by traditional defence mechanisms.

If your organisation uses Jira or Confluence on a Standard, Premium, or Enterprise plan, Rovo is probably already active. Check it today. If the PromptArmor document vector worries you — and it should — the only proactive mitigation available as of August 10, 2026 is to restrict Rovo access to the applications and user groups that strictly need it. Do not wait for a patch: none has been announced.

References

• PromptArmor — Atlassian Rovo prompt injection, August 5, 2026
• Varonis Threat Labs — RovoBlast, August 8, 2026
• Bugcrowd Disclosure — rovoChatPrompt data exfiltration
• Atlassian — Managing Rovo access
• Atlassian — Web search option for Rovo
• The Hacker News — Atlassian Rovo Can Be Tricked Into Sending Data, August 8, 2026