{
  "entry": {
    "kind": "vuln",
    "slug": "rovoblast-one-link-makes-atlassian-rovo-exfiltrate-jira-and-confluence",
    "name": "rovoblast-one-link-makes-atlassian-rovo-exfiltrate-jira-and-confluence",
    "vendor": "Atlassian Rovo",
    "description": "Varonis showed that Rovo Chat honoured a rovoChatPrompt URL parameter that pre-filled the assistant with attacker-supplied instructions, so a signed-in employee who clicked a crafted link had Rovo search and summarize everything that employee was authorized to reach, then send the result outward. No approval step stood in the way because the victim appeared to have typed the prompt. Atlassian fixed the one-click link route server-side on 8 July with no customer action required, but the content-borne route PromptArmor described two days before this disclosure, hidden instructions inside uploaded or connected content, has no version-specific fix as of August 2026.",
    "website": "https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-07",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "rovoblast-one-link-makes-atlassian-rovo-exfiltrate-jira-and-confluence",
      "aliases": [
        "ti-073"
      ],
      "title": "RovoBlast: One Link Makes Atlassian Rovo Exfiltrate Jira and Confluence Data",
      "summary": "Varonis showed that Rovo Chat honoured a rovoChatPrompt URL parameter that pre-filled the assistant with attacker-supplied instructions, so a signed-in employee who clicked a crafted link had Rovo search and summarize everything that employee was authorized to reach, then send the result outward. No approval step stood in the way because the victim appeared to have typed the prompt. Atlassian fixed the one-click link route server-side on 8 July with no customer action required, but the content-borne route PromptArmor described two days before this disclosure, hidden instructions inside uploaded or connected content, has no version-specific fix as of August 2026.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Data exfiltration"
      ],
      "componentType": "agent",
      "component": {
        "name": "Atlassian Rovo",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Atlassian Rovo (link route fixed server-side 2026-07-08; content-borne route unfixed as of August 2026)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-07",
      "modifiedAt": "2026-08-07",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html"
        }
      ],
      "mitigation": "The link route needs no patch. Treat the content route as live: scope which Jira, Confluence and SharePoint sources Rovo may reach and tighten the connected-account permissions behind it, rather than relying on the assistant to decline instructions it finds inside content it was asked to read.",
      "detectedByAnomity": true
    }
  }
}