Meet Rovo: Atlassian’s chatty assistant that helps you wrangle Jira issues and Confluence pages. Two security teams independently showed it can be persuaded to hand over data that a signed-in user can already see — but to an attacker’s server instead of your dashboard. One of the attacking tricks has been patched; the other was reported as still working when published.

What happened (short, slightly dramatic version)

Two different research teams found two different ways to get Rovo to do naughty things:

  • Link preload trick: A specially crafted URL parameter could preload attacker instructions into Rovo Chat so that a single click from a signed-in user would run those instructions with the user’s permissions and exfiltrate data. That chain was disclosed via a bug bounty and Atlassian applied a server-side fix on July 8, 2026.
  • Content-borne prompt injection: Another team showed you could hide instructions inside content that Rovo reads (for example, an uploaded document). The assistant would then search Jira/Confluence, append results to an attacker-controlled URL, fetch it, and the attacker would see the stolen content in their server logs. The researchers said this did not require a separate human approval step and still worked even with the web-search option turned off when they published their write-up.

Other technical notes: the URL-preload report demonstrated theft of things like private API keys and was tested against Jira and connector-backed data. The content-based report pointed out a root issue: nothing stops Rovo from opening URLs that it constructed itself, so a model-crafted request can become an outbound leak. There’s also a potential second pathway — rendering of images or URLs from model output — that could leak data, although a full chain for that route wasn’t shown.

What admins should actually do (practical checklist)

This is the boring-but-useful part: one of the two routes has been closed by Atlassian, but the other was reported as unresolved at the time of publication. Treat Rovo’s powerful reach as both a feature and a risk, and take these steps:

  • Review who and what can use Rovo in your org: block Rovo features for apps where AI access is unnecessary or risky.
  • Limit Rovo by app and user group where possible; don’t rely solely on the web-search toggle as a complete safeguard.
  • Tighten permissions and scope on connectors (Confluence, Jira, SharePoint, Outlook, etc.) so an assistant account can’t see more than it needs.
  • Rotate any secrets (API keys, tokens) if you suspect they might have been exposed, and audit access logs for suspicious outbound fetches.
  • Confirm whether your tenant benefitted from the July 8, 2026 fix and keep watch for vendor updates about the content-borne chain.

Remember: Rovo only has access to what a signed-in user can reach, so these attacks leverage normal permissions rather than breaking tenant-wide auth. That makes careful permission hygiene and connector scope the best defense.

Quick closing: one route is patched, one was reported but not confirmed fixed when published — so don’t be lazy. Audit, tighten, and rotate. Your future self (and your CISO) will high-five you.

one-click flaw | server-side fix