RovoBlast: One-Click Parameter-to-Prompt Injection in Atlassian Rovo AI Exposes Confluence, Jira, and SharePoint Data
RovoBlast: One-Click Parameter-to-Prompt Injection in (TL-2026-1942), also tracked as RovoBlast, is a critical-severity software vulnerability, first published 2026-08-08. It has no confirmed attribution, affects Atlassian Rovo (Rovo Chat / ResearchAgent), maps to 12 MITRE ATT&CK / ATLAS techniques (AML.T0011.003, AML.T0025, AML.T0036), and is covered by 9 detection rules and 7 indicators of compromise.
Key facts for TL-2026-1942
- Threat ID
- TL-2026-1942
- Also known as
- RovoBlast
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-08-08
- Last reviewed
- 2026-08-08
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, financial-services, government administration, health, professional-services, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in RovoBlast: One-Click Parameter-to-Prompt Injection in
Malware and tooling: One, Atlassian Rovo ResearchAgent
Varonis Threat Labs disclosed RovoBlast, a one-click parameter-to-prompt (P2P) injection flaw in Atlassian's Rovo AI assistant: an unvalidated _rovoChatPrompt URL parameter seeded attacker instructions directly into a victim's live Rovo Chat session, and a blank organization-ID field silently routed the session into the victim's own default org. A single click let Rovo's ResearchAgent run the injected instructions with the victim's privileges and exfiltrate Confluence, Jira, and SharePoint data to an attacker-controlled destination, with no jailbreak or permission bypass required. Atlassian shipped a server-side fix on 2026-07-08 before the findings were published on 2026-08-08.
How RovoBlast: One-Click Parameter-to-Prompt Injection in works
RovoBlast is a parameter-to-prompt (P2P) injection vulnerability that Varonis Threat Labs found in Atlassian Rovo, the AI assistant embedded across Jira, Confluence, Bitbucket, Slack, Microsoft 365, Google Workspace, and 50+ other connectors. It is the second entry in Varonis's P2P injection research line, following January 2026's 'Reprompt' finding against Microsoft Copilot, which established the same attack class: encoding an attacker's prompt directly into a URL parameter so it auto-populates and executes inside a trusted AI chat session the instant the link loads.
In Rovo's implementation, the attacker-controlled string traveled in the _rovoChatPrompt (also observed as rovoChatPrompt) parameter on the Rovo Chat endpoint (e.g. https://home.atlassian.com/chat?rovoChatPathway=chat&_rovoChatPrompt=<prompt>). Rovo pre-filled this content straight into the chat window with no warning, confirmation, or 'taint' indicator that the session had been seeded by an external source. A second, compounding flaw sat next to it: the URL's organization-ID field could be left blank, and Atlassian would still silently route the poisoned session into the victim's own default organization rather than rejecting it, removing what would otherwise have been a visible friction point for the victim to notice something was wrong.
Once the injected prompt loaded, exploitation required little to no additional guardrail bypassing -- Varonis found Rovo 'often required little to no guardrail bypassing to retrieve and summarize sensitive data.' The chain relied on ResearchAgent, one of Rovo's built-in autonomous agents, advertised for 'deep multi-source open web research' and 'multi-step browsing and navigation across arbitrary websites' without further user interaction. The injected instructions directed ResearchAgent to locate accessible data across connected systems, embed it into the path of an attacker-controlled image URL, and then fetch that URL -- using the agent's own legitimate web-fetch/image-retrieval tool call as the exfiltration channel to an attacker-controlled server. In their proof-of-concept, researchers demonstrated extraction of a private API key alongside Confluence pages, Jira tickets, SharePoint content (including content with personal data), data from connected relational databases, and archived/uploaded files. Critically, the access was scoped to whatever the signed-in victim could already reach -- Varonis did not demonstrate a tenant-wide authorization bypass or privilege escalation; the danger is entirely that a single click let an external party direct an already-privileged agent's actions.
RovoBlast was reported through Bugcrowd (P2 priority, $6,000 bounty) and Atlassian deployed a server-side fix on 2026-07-08, which the reporter validated; no CVE identifier or CVSS score had been assigned as of publication, and NVD/CISA KEV carried no matching entry. Atlassian's public response characterized the flaw as representative of 'a class of attack that affects AI systems across the industry' and recommended customers verify the source of content their AI assistants act on. Varonis presented the research at DEF CON 34 / Black Hat USA 2026 alongside its broader AI-agent security work.
A second, independently discovered and functionally related issue in the same product deserves attention alongside RovoBlast: AI security firm PromptArmor separately reported an indirect prompt-injection vector in Rovo on 2026-05-23, where hidden instructions embedded in an uploaded document (no crafted link or click required) caused ResearchAgent to gather and exfiltrate Jira/Confluence data via the same class of insecure, agent-driven URL retrieval -- and, per PromptArmor, this exploitation path persisted even when an organization's web-search setting was disabled. As of PromptArmor's 2026-08-05 publication, Atlassian had acknowledged the report (case number issued 2026-05-25) but had not shipped a fix despite follow-ups on 2026-06-04 and 2026-07-29. Defenders relying on the RovoBlast fix alone should treat Rovo's document-ingestion and URL-retrieval tooling as a still-open exposure pending confirmation that PromptArmor's finding has also been remediated.
MITRE ATT&CK / ATLAS techniques used in TL-2026-1942
execution
AML.T0011.003 Malicious Link; AML.T0051 LLM Prompt Injection
Exfiltration
AML.T0025 Exfiltration via Cyber Means; T1567 Exfiltration Over Web Service
Collection
AML.T0036 Data from Information Repositories; T1213 Data from Information Repositories; T1213.001 Confluence; T1213.002 Sharepoint
Initial Access
AML.T0049 Exploit Public-Facing Application; T1190 Exploit Public-Facing Application
Execution
AML.T0053 AI Agent Tool Invocation; T1204.001 Malicious Link
Affected products and versions in RovoBlast: One-Click Parameter-to-Prompt Injection in
- Atlassian — Rovo (Rovo Chat / ResearchAgent)
Vulnerable versions: Rovo Chat web endpoint (home.atlassian.com/chat) prior to Atlassian's 2026-07-08 server-side fix
Fixed in: Rovo Chat as of 2026-07-08 (server-side remediation; no client-side update required) - Atlassian — Rovo (document upload / URL-retrieval tool)
Vulnerable versions: Rovo's document-ingestion and URL-retrieval tooling as of PromptArmor's 2026-08-05 publication (separately disclosed indirect prompt-injection vector, distinct from RovoBlast)
Remediation for RovoBlast: One-Click Parameter-to-Prompt Injection in
Patches
- Atlassian applied a server-side fix on 2026-07-08 for the RovoBlast one-click parameter-to-prompt injection (no customer-side patch or update required); the reporter validated the fix via Bugcrowd
Immediate actions
- Confirm Atlassian's 2026-07-08 server-side fix is in effect by validating that the Rovo Chat endpoint no longer treats the _rovoChatPrompt and organization-ID URL parameters as trusted, auto-executing input
- Audit Rovo/ResearchAgent activity logs for chat sessions seeded via URL query parameters and for outbound web-fetch or image-retrieval calls to unrecognized external domains
- Review and restrict ResearchAgent's default connector scope (Confluence, Jira, SharePoint, Bitbucket, Slack, Microsoft 365, Google Workspace) to least privilege per user role
- Warn users not to click unsolicited Rovo/Atlassian chat links -- exploitation required only a single click and produced no jailbreak or permission-bypass warning
- Confirm remediation status of the separate PromptArmor-disclosed indirect prompt-injection vector (hidden instructions in uploaded documents), which was still unpatched as of 2026-08-05
Workarounds
- Disable or restrict ResearchAgent's autonomous multi-step web browsing / URL-fetch capability where it is not operationally required
- Treat any Rovo/Atlassian chat link containing rovoChatPrompt, _rovoChatPrompt, or similar query parameters as untrusted and do not click
Longer-term hardening
- Deploy an AI/LLM-aware web proxy or DLP layer that inspects agent-initiated outbound requests (URL fetch, image retrieval) for exfiltration patterns such as sensitive data encoded in query strings or URL paths
- Require explicit, visible user confirmation before an AI agent executes instructions that originate from URL parameters or other externally supplied, unauthenticated sources
- Adopt a 'taint tracking' or provenance-labeling model for AI chat sessions so content seeded by external links is visibly flagged as untrusted before the agent acts on it
- Establish a standing review process for AI-agent connector permissions and autonomous tool invocation, given Atlassian's own framing of this as an industry-wide AI-agent risk class
Weaknesses (CWE) in RovoBlast: One-Click Parameter-to-Prompt Injection in
CWE-20, CWE-345, CWE-441
Timeline of RovoBlast: One-Click Parameter-to-Prompt Injection in
- Varonis Threat Labs publishes 'Reprompt', the prior parameter-to-prompt (P2P) injection research against Microsoft Copilot that established the attack class later reused against Atlassian Rovo.
- AI security firm PromptArmor reports a separate, related indirect prompt-injection / insecure URL-retrieval vulnerability in Atlassian Rovo to Atlassian.
- Atlassian acknowledges PromptArmor's report and issues an internal case number.
- PromptArmor follows up with Atlassian for a status update on its report; receives no substantive response.
- Atlassian deploys a server-side fix for RovoBlast, the one-click parameter-to-prompt injection flaw reported by Varonis Threat Labs via Bugcrowd (P2 severity, $6,000 bounty); the reporter validates the fix.
- Varonis publicizes its Black Hat USA 2026 / DEF CON 34 AI security research slate, which includes the RovoBlast findings.
- PromptArmor sends a second follow-up to Atlassian; its separately disclosed indirect-injection vector remains unpatched.
- PromptArmor publishes its findings on the still-unresolved indirect prompt-injection / URL-retrieval exfiltration vector in Rovo.
- Varonis Threat Labs publishes the RovoBlast technical disclosure; SecurityWeek, The Hacker News, and other outlets report on the now-patched one-click parameter-to-prompt injection flaw.
Sources cited for RovoBlast: One-Click Parameter-to-Prompt Injection in
- RovoBlast
- Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data
- Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers
- Atlassian Rovo Exfiltrates Data, Bypassing Controls
- Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data
- New 'Reprompt' Attack Silently Siphons Microsoft Copilot Data
- Reprompt attack hijacked Microsoft Copilot sessions for data theft
- Researchers Reveal Reprompt Attack Allowing Single-Click Data Exfiltration From Microsoft Copilot
- Varonis Heads to Black Hat USA 2026 and DEF CON 34
- Atlassian Rovo Is Leaking Your Data -- And the Admin Fix Doesn't Work
- Atlassian Rovo Data Exfiltration: Why Turning Off Web Search Won't Stop Prompt Injection
Threats related to RovoBlast: One-Click Parameter-to-Prompt Injection in
Detection coverage for TL-2026-1942
As of 2026-08-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1942 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.