Affected Systems

Atlassian Rovo assistant on Standard, Premium, and Enterprise plans. Affects organizations with Rovo enabled (default setting). Exploitable by authenticated users who interact with attacker-controlled content (documents) or links (rovoChatPrompt parameter). Access limited to data the victim user can already reach in Jira, Confluence, SharePoint, and Outlook connectors.

Exploitation Status

Two independent proof-of-concept attacks demonstrated. Link-based attack (RovoBlast via rovoChatPrompt parameter) patched server-side by Atlassian on July 8, 2026. Content-based attack (indirect prompt injection via uploaded files) reported by PromptArmor on May 23, 2026; patch status unconfirmed as of August 5, 2026. No CVE assigned. No evidence of active exploitation in the wild.

Business Impact

Attackers can exfiltrate sensitive Jira tickets, Confluence pages, API keys, and data from connected third-party apps (SharePoint, Outlook) by tricking authenticated users into clicking malicious links or uploading poisoned documents. Data exposure is scoped to victim's existing permissions but can span multiple integrated systems. No server-side patch available for content-based vector; mitigation requires administrative controls. Organizations using Rovo with broad connector integrations face higher risk. Disabling web search does not prevent exfiltration via URL-retrieval capability.

Urgency

🟡 Within a week

Recommended Actions

  • Audit which apps and user groups have Rovo access enabled via Atlassian admin console; restrict to business-critical users only
  • Disable Rovo features for sensitive apps (Jira, Confluence) using per-app controls if business requirements allow
  • Implement user awareness training on risks of uploading untrusted documents or clicking Rovo links from external sources
  • Monitor outbound HTTP requests from Atlassian infrastructure for unusual destinations or data patterns in URL parameters
  • Contact Atlassian support to confirm patch status for content-based prompt injection (PromptArmor disclosure) and request timeline if unpatched

---

# Threat Actor Context

Actor Profile

PromptArmor is an AI security research firm that identified indirect prompt injection vulnerabilities in Atlassian's Rovo AI assistant. The actor operates as a legitimate security researcher, motivated by discovering and disclosing AI-specific attack vectors in enterprise collaboration tools. PromptArmor disclosed their findings to Atlassian on May 23, 2026, following responsible disclosure practices, though communication gaps occurred during the remediation process.

TTPs (Tactics, Techniques, Procedures)

The attack leverages indirect prompt injection (conceptually aligned with T1059 - Command and Scripting Interpreter adapted for LLM contexts). Attacker-controlled instructions are embedded in documents or content that Rovo processes, causing the AI assistant to execute unauthorized data collection and exfiltration. The technique exploits T1567.002 (Exfiltration Over Web Service - Exfiltration to Cloud Storage) by appending collected Jira and Confluence data to attacker-controlled URLs. The attack bypasses web-search controls by exploiting a separate URL-retrieval capability that lacks validation of whether URLs were user-initiated or agent-constructed. A secondary exfiltration vector through Markdown image rendering in model output was also identified but not fully demonstrated.

Targets & Patterns

The vulnerability targets organizations using Atlassian Rovo on Standard, Premium, and Enterprise plans, with particular risk to software development teams and organizations heavily reliant on Jira and Confluence for collaboration. The attack surface includes any authenticated user who can be socially engineered to upload malicious documents or interact with poisoned content through Rovo. The data at risk is scoped to what the victim's account permissions allow, but in enterprise environments where Rovo connects across Atlassian products and third-party integrations (SharePoint, Outlook), a single compromised account can provide broad access. The attack pattern suggests targeting of high-value users with elevated permissions to Jira tickets, Confluence pages, and connected services.

Historical Context

This research represents PromptArmor's contribution to the emerging field of AI assistant security, specifically indirect prompt injection attacks against enterprise LLM applications. The disclosure occurred in parallel with independent research by Varonis Threat Labs, which discovered a related but distinct attack vector (RovoBlast, CVE-less, fixed July 8, 2026 via rovoChatPrompt parameter remediation). PromptArmor's content-borne injection path remained unconfirmed as patched as of August 5, 2026, nearly a month after Varonis's link-based vector was closed server-side. The disclosure timeline shows initial contact May 23, 2026, case assignment May 25, follow-ups June 4 and July 29, and public disclosure August 5, 2026, with Atlassian communication described as ceased after initial acknowledgment.

Defensive Recommendations

  • Restrict Rovo access to specific apps and user groups using Atlassian's granular controls rather than organization-wide deployment, limiting blast radius of successful prompt injection attacks
  • Monitor outbound HTTP requests from Rovo sessions for anomalous URL patterns, particularly requests appending structured data to external domains not in approved connector lists
  • Implement data loss prevention controls that inspect and alert on unusual volumes of Jira/Confluence content being accessed in single AI assistant sessions
  • Educate users on risks of uploading untrusted documents to AI assistants and establish policies requiring review of external content before Rovo processing
  • Disable web-search functionality for Rovo at the organization level if not operationally required, though note PromptArmor reported this control was bypassed via separate URL-retrieval capabilities as of August 5, 2026