# Data Leak Vulnerabilities Discovered in Atlassian's Rovo Assistant Security firms found that Rovo could exfiltrate Jira and Confluence data to attackers through different methods. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-08-08 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/ea9bcef4-98fb-4e9e-9f64-34e4d77f2830 ## Security Vulnerabilities in Rovo Two independent security firms uncovered critical vulnerabilities in Atlassian's AI assistant Rovo. PromptArmor and Varonis Threat Labs demonstrated that Rovo could leak Jira and Confluence data to attackers through different techniques. PromptArmor proved that a simple uploaded file could make the assistant collect internal data and send it externally. Varonis achieved similar data exfiltration by manipulating a link parameter. ## PromptArmor's Findings In its August 5, 2026 report, PromptArmor showed Rovo could leak data even with web search disabled. Commands hidden in user-uploaded documents could execute when Rovo processed Jira ticket organization requests. The assistant would append collected data to an attacker-controlled URL. Users returning to the chat later would only see suggested ticket updates with no traces of the data exfiltration. ## Varonis's Discovery Varonis Threat Labs developed a different attack method using the rovoChatPrompt URL parameter. With this technique, a single click from an authenticated user was enough to make Rovo execute attacker commands. Atlassian fixed this server-side vulnerability on July 8, 2026, which had led to leakage of a private API key from Confluence. Rated P2 on Bugcrowd, this vulnerability earned a $6,000 bounty. ## Not Zero-Click But Still Risky PromptArmor's method doesn't technically qualify as zero-click attack, as victims must first expose Rovo to poisoned content and make a normal request. However, the exfiltration step requires no separate approval. The web search finding is particularly significant because Atlassian offers web search as an organization-level setting to expand Rovo's sources. ## Root Cause: Lack of URL Validation Reports identify the core issue as Rovo's failure to verify whether opened URLs were self-generated. Additionally, Rovo's ability to render Markdown images from model output creates a second potential data exfiltration path. Atlassian's documentation doesn't clarify whether self-composed requests fall under the same controls as other web searches, raising important security questions. ## Company Response and Fixes PromptArmor disclosed the issue to Atlassian on May 23, 2026, receiving a case number two days later. As of August 8, 2026, no post-publication updates were available. Varonis reported through Bugcrowd, with Atlassian deploying a server-side fix on July 8. Neither disclosure confirms whether the fix addressed content-borne attack paths. ## Risk Management for Organizations Rovo comes enabled by default for apps on Standard, Premium, and Enterprise plans, accessible to all organization members. Beyond all-or-nothing choices, administrators can block Rovo features for specific supported apps. However, blocking one Jira-family app on multi-app sites doesn't remove shared capabilities, leaving Rovo Search, Chat and Create features available. ## Security Warning for AI Assistants This incident serves as an important case study for security risks in AI assistants. In tools deliberately integrated across products like Atlassian's ecosystem, a single account's access represents intended functionality. Organizations adopting such tools must carefully review permission management and data protection policies to mitigate these emerging risks effectively. ## Sources covering this story - https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._