Atlassian Rovo Can Be Talked Into Leaking Your Confluence Data
Two research teams showed Rovo exfiltrating Jira and Confluence data through prompt injection. One issue is fixed, one was still open in early August — and turning off web search doesn't help.
Two separate research teams have shown that Atlassian's Rovo assistant can be talked into handing over Jira and Confluence data. Neither attack needs a software exploit in the usual sense. Both work by getting text in front of the assistant and letting it follow instructions.
Attack one: hide the instructions in a document
PromptArmor demonstrated an indirect prompt injection carried inside an uploaded file. A user asks Rovo to process the document; the concealed instructions tell Rovo to collect internal data and push it out through a URL request, with no separate approval step in between.
The exfiltration path is Rovo's markdown image rendering — the assistant fetches an attacker-controlled image URL with the stolen data embedded in it.
The detail worth flagging for anyone who thought they'd already mitigated this: turning off web search does not stop it. Rovo's URL retrieval is a separate capability from the web-search toggle. PromptArmor disclosed on 23 May 2026 and reported no confirmed fix as of early August.
Attack two: put the instructions in the link
Varonis Threat Labs found that the rovoChatPrompt URL parameter preloads instructions into Rovo Chat. They called it RovoBlast. An authenticated user clicks a crafted link, and Rovo finds information that user can reach, places it into the path of an attacker-controlled image URL, and fetches the image. One click, data delivered.
The demonstration pulled a private API key out of Confluence, and the technique was tested against Jira, SharePoint and Outlook connectors. Atlassian fixed this one server-side on 8 July 2026, validated through Bugcrowd, with a $6,000 bounty. Neither issue has a CVE.
What this means in practice
Both attacks are bounded by the signed-in user's own permissions. The assistant isn't escalating privilege; it's exercising the user's access on an attacker's behalf. That sounds reassuring until you consider how much a long-tenured employee can read in a mature Confluence instance.
Atlassian offers app-level and user-group access controls for Rovo, and those are now doing real security work rather than administrative tidying.
The broader pattern is the one to internalise. Any assistant that can (a) read untrusted content and (b) make outbound requests has an exfiltration channel, and image rendering is a channel people consistently forget to count. When you review an AI assistant for deployment, stop asking only what it can read. Ask what it can send, and where.
Source: Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers — The Hacker News