RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt Injection in Atlassian Rovo Exposes Confluence, Jira, SharePoint, and Bitbucket Data
RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt (TL-2026-1939), also tracked as RovoBlast, is a critical-severity software vulnerability, first published 2026-08-08. It has no confirmed attribution, affects Atlassian Rovo (Rovo Chat / rovoChatPrompt endpoint), maps to 13 MITRE ATT&CK techniques (T1027, T1048.003, T1071.001), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-1939
- Threat ID
- TL-2026-1939
- Also known as
- RovoBlast
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-08-08
- Last reviewed
- 2026-08-08
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt
Malware and tooling: One, ResearchAgent
Varonis Threat Labs (researcher Dolev Taler) disclosed RovoBlast, a one-click vulnerability in Atlassian's enterprise AI assistant Rovo: an unauthenticated rovoChatPrompt URL parameter let an attacker-crafted link seed arbitrary instructions directly into a victim's live, trusted Rovo chat session with no jailbreak, permission bypass, or confirmation prompt. Using Rovo's built-in ResearchAgent, the injected instructions could autonomously enumerate and exfiltrate Confluence pages, Jira tickets, SharePoint content, and other connected-system data to an attacker-controlled server via an HTTP image-fetch side channel. Atlassian deployed a server-side fix (2026-07-08) neutralizing automatic execution of rovoChatPrompt content before Varonis published its findings and presented at DEF CON 34 (2026-08-08).
How RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt works
RovoBlast exploits a Parameter-to-Prompt (P2P) injection flaw in the `rovoChatPrompt` query parameter accepted by Atlassian's Rovo AI assistant at `home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt=<prompt>`. When an authenticated user opens a specially crafted link, Rovo pre-fills and auto-executes the embedded text as if it were the user's own genuine chat query, with no warning, confirmation dialog, or visual indicator that the session had been seeded by an outside party. Varonis found that the organization-scoping portion of the URL (`/o/<org-id>/chat`) could be left blank, and Atlassian would silently route the request into the victim's own default organization, removing the need for an attacker to know or guess the target org ID.
Once seeded, the attacker-controlled prompt could invoke ResearchAgent, a built-in Rovo capability described by Varonis as able to "autonomously conduct multi-source web research and navigate across arbitrary sites." This let the injected instructions harvest sensitive data reachable through Rovo's federated access layer — Confluence pages, Jira tickets, Bitbucket repositories, and, via Rovo's 50+ third-party Connectors, Slack, Microsoft 365, Google Workspace, SharePoint, and other integrated systems, all evaluated with the victim's own live privileges.
The Bugcrowd technical disclosure underlying the research (submitted by researcher handle "loacker", reported 2025-11-04, triaged as P2 with a $6,000 bounty on 2026-01-06) documents a working proof-of-concept exfiltration channel: the crafted prompt used indirect, guardrail-evading phrasing (assigning the victim's harvested email address to an "emoji variable," then asking Rovo to "identify the bird" in an image at `https://<attacker-domain>/bird/<emoji>/bird.jpg`) to trick Rovo into requesting an attacker-hosted image whose URL path carried the exfiltrated data as an HTTP GET request — leaving no obvious trace in the visible chat transcript. The PoC used the domain `kizafair.com` as the attacker-controlled logging endpoint.
Atlassian remediated the issue server-side on 2026-07-08, disabling automatic execution of rovoChatPrompt-seeded instructions, and characterized the underlying issue as a "phishing-class" attack requiring a user to interact with untrusted, attacker-supplied content — consistent with vulnerabilities affecting AI systems industry-wide. Varonis Threat Labs published RovoBlast and presented it at DEF CON 34 on 2026-08-08, noting that Rovo cannot be fully uninstalled from an Atlassian Cloud tenant, and that no taint-labeling exists to distinguish externally seeded prompt content from a user's own input. No CVE has been assigned. This disclosure is distinct from, but thematically related to, a separate unpatched zero-click Rovo prompt-injection flaw disclosed by PromptArmor on 2026-08-05 that abuses Rovo's URL-retrieval tool even when web search is administratively disabled.
MITRE ATT&CK techniques used in TL-2026-1939
Defense Evasion
T1027 Obfuscated Files or Information
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Command and Control
Collection
T1119 Automated Collection; T1213 Data from Information Repositories; T1213.001 Confluence; T1213.002 Sharepoint; T1213.003 Code Repositories; T1213.005 Messaging Applications
Initial Access
T1199 Trusted Relationship; T1566.002 Spearphishing Link
Execution
Resource Development
Affected products and versions in RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt
- Atlassian — Rovo (Rovo Chat / rovoChatPrompt endpoint)
Vulnerable versions: Rovo Chat prior to the 2026-07-08 server-side fix
Fixed in: Rovo Chat post 2026-07-08 server-side remediation
Remediation for RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt
Patches
- Atlassian server-side fix deployed 2026-07-08 disabling automatic execution of rovoChatPrompt-seeded instructions
Immediate actions
- Confirm the Atlassian server-side patch (deployed 2026-07-08) has propagated to the tenant; verify rovoChatPrompt links no longer auto-execute
- Audit web-proxy/SIEM/email-gateway logs for historical links containing the rovoChatPrompt URL parameter
- Monitor outbound requests from Rovo-integrated infrastructure for unexpected external image/URL fetches that could indicate exfiltration attempts
- Warn users not to click unsolicited Atlassian/Rovo chat links from external senders
Workarounds
- Restrict or disable ResearchAgent and other autonomous Rovo agents for tenants pending confirmation of patch deployment
- Block or alert on inbound links containing the rovoChatPrompt parameter at email and URL-filtering gateways
Longer-term hardening
- Require explicit user confirmation before any AI-agent chat session executes instructions seeded via URL parameters or other externally controlled inputs
- Implement provenance/taint tracking so Rovo (and similar AI assistants) can distinguish user-authored prompts from externally seeded content
- Apply least-privilege scoping to Rovo Connectors (Confluence, Jira, Bitbucket, SharePoint, Slack, Microsoft 365, Google Workspace) so a single seeded session cannot traverse all connected systems
- Gate autonomous agent capabilities (e.g., ResearchAgent) that perform outbound web requests behind human-in-the-loop confirmation, especially when session data could be embedded in the request
Weaknesses (CWE) in RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt
CWE-1427, CWE-20, CWE-441
Timeline of RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt
- Vulnerability in the rovoChatPrompt URL parameter reported to Atlassian via Bugcrowd by researcher handle 'loacker'.
- Atlassian triages the Bugcrowd submission as P2 priority (AI Application Security / Sensitive Information Disclosure) and issues a $6,000 bounty.
- PromptArmor separately reports a distinct zero-click Rovo prompt-injection/data-exfiltration flaw to Atlassian, receiving an acknowledgment and ticket ID.
- Atlassian deploys a server-side fix disabling automatic execution of rovoChatPrompt-seeded instructions, resolving the RovoBlast vulnerability.
- PromptArmor publicly discloses its separate, still-unpatched zero-click Rovo indirect-prompt-injection data-exfiltration flaw.
- Atlassian confirms the fix publicly, characterizes RovoBlast as a 'phishing-class' attack requiring interaction with untrusted content, and states it is working with customers on additional protective controls.
- Varonis Threat Labs (researcher Dolev Taler) publishes the RovoBlast research and presents it at DEF CON 34.
Sources cited for RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt
- Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data
- RovoBlast
- One-Click Data Exfiltration via rovoChatPrompt URL Parameter (Confluence / Rovo)
- Atlassian Rovo Exfiltrates Data, Bypassing Controls
- A vulnerability has been discovered in Atlassian's AI 'Rovo' that allows internal company data to be transmitted externally simply by having it read documents
- Atlassian Rovo Is Leaking Your Data — And the Admin Fix Doesn't Work
- Atlassian Rovo AI Leaks Jira and Confluence Data via Hidden Prompt Injection
- Explore Atlassian Rovo: Search, Chat, and Agents
Threats related to RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt
Detection coverage for TL-2026-1939
As of 2026-08-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1939 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.