Atlassian Rovo AI data leak via malicious links

Published July 26, 2026

Atlassian Rovo's AI assistant can leak your company's private data if you click an attacker's link. Attackers trick the AI into fetching and sending sensitive info from your work apps.

Report priority
Medium
Targets
Atlassian+5 more

How it works

  • An attacker sends a specially made link that tricks Atlassian Rovo's AI into running commands it shouldn't.
  • The AI then fetches and sends private company data from connected apps without you noticing.

What to do

Check if you use Atlassian Rovo and have linked it to your company's apps or data sources. If so, you're affected unless you've updated to the fixed version.

Update Rovo to the latest version through Atlassian's official update channel and verify the installed version in your Rovo settings.

Technical details

Affected software: Atlassian, Apache, Linux, Android, OpenSSL, Anthropic

You get a link in a work chat or email. When you click it, the AI inside Rovo thinks it's a normal request but secretly pulls data from your company's apps, like customer lists or project files, and sends it to the attacker. The hacker now has your company's private info without breaking in.

Atlassian Rovo, an enterprise AI assistant integrated with Jira, Confluence, Bitbucket, and third-party services, suffers from RovoBlast (NEWS-2c7f683b001f431c1c), a flaw where a malicious link forces attacker-controlled instructions into a user's authenticated session. Researchers Dolev Taler and Mark Vaitsman (Varonis Threat Labs) demonstrated that by crafting a link targeting Rovo's rovoChatPrompt parameter, an attacker could inject arbitrary prompts into the AI assistant. Since Rovo operates with elevated permissions, searching, querying, and acting across connected systems, this allowed sensitive data retrieval without requiring traditional permission bypasses or jailbreaks.

The attack leverages a Parameter-to-Prompt (P2P) technique, previously documented in Microsoft Copilot vulnerabilities, exploiting untrusted input in AI-driven workflows. Atlassian addressed the issue after responsible disclosure.

References

View Original Source