Atlassian closes one-click Rovo data leak flaw

Atlassian has fixed a security flaw in its Rovo artificial intelligence assistant that could have allowed attackers to turn a single malicious link into a channel for stealing sensitive corporate information from services accessible to a logged-in employee.

The vulnerability, dubbed RovoBlast, exploited the way Rovo Chat processed externally supplied information embedded in URLs. An attacker could construct a link containing malicious instructions and persuade an authenticated user to click it. The instructions would then enter the victim’s Rovo session, where they could direct the AI assistant to locate information and transmit it to infrastructure controlled by the attacker.

The attack centred on a Rovo URL parameter called rovoChatPrompt, which was designed to pre-populate the assistant’s chat interface. The mechanism effectively created a parameter-to-prompt injection route. External information intended to help initiate a legitimate Rovo conversation could instead carry attacker-written commands into a trusted session.

No jailbreak, password theft or conventional permissions bypass was required. Rovo operated with the legitimate access rights of the victim. That distinction means the flaw did not automatically grant an attacker access to information beyond the employee’s permissions, but it could exploit everything that the compromised AI session was already authorised to retrieve.

Tests demonstrated the potential extraction of information from Confluence pages, Jira tickets and Microsoft SharePoint content. One proof of concept involved a private API key stored in Confluence. Tests also covered information accessible through SharePoint and Outlook integrations. The stolen material could be incorporated into an attacker-controlled URL and sent outside the organisation when Rovo retrieved that address.

The risk was amplified by Rovo’s role as a federated AI layer connecting workplace applications. Its capabilities can extend across Jira, Confluence and Bitbucket as well as external services including Microsoft 365, Google Workspace and Slack. Its connector ecosystem can link the assistant with dozens of other enterprise platforms.

Rovo also provides agentic capabilities that can perform multi-stage operations with limited additional intervention. Such functionality is intended to let employees search company knowledge, analyse material and automate work. RovoBlast illustrated how those same capabilities can expand the impact of malicious instructions when an AI system treats attacker-controlled input as trustworthy.

The flaw was reported through Atlassian’s vulnerability disclosure process and was classified as a P2 security issue. Atlassian deployed a server-side fix on July 8 and the remediation was subsequently validated. A $6,000 bounty was awarded for the report. Customers do not need to install a separate patch for the one-click vulnerability because the correction was made within Atlassian’s cloud infrastructure.

No CVE identifier had been assigned to RovoBlast as of August 8, and there was no disclosed evidence that the technique had been exploited against an organisation outside controlled security testing.

The disclosure comes alongside separate research into another prompt-injection route affecting Rovo. That technique involves malicious instructions hidden within material that Rovo is asked to process, rather than commands delivered through a crafted chat link. A user might, for example, upload a poisoned document and then ask Rovo to perform a normal workplace task involving Jira information.

Tests of that method showed that concealed instructions could persuade the assistant to collect Jira and Confluence information and append it to an attacker-controlled URL. The outbound request could expose the material through server logs without asking the user to approve the transfer separately.

That attack was also reported to Atlassian, but its remediation status remained unconfirmed following its August 5 publication. Tests indicated that disabling Rovo’s web-search setting did not prevent the demonstrated attack because the assistant could use a separate URL-retrieval capability.

The findings are sharpening scrutiny of enterprise AI assistants that combine broad data access with autonomous actions. Traditional permission controls can limit what an employee and therefore an AI agent can retrieve, but they do not necessarily prevent authorised information from being redirected when the agent itself is manipulated.