Atlassian Rovo AI exfiltrates data, bypassing controls: attacker logs contain Jira tickets and Confluence docs.

Context

Atlassian’s Rovo AI is a multi-purpose agent that operates across Atlassian’s product suite (Jira, Confluence, etc.).

Vulnerabilities have been identified that enable data exfiltration across an Atlassian tenant (Jira tickets, Confluence docs, etc.) via indirect prompt injection. This attack executes without requiring any human-in-the-loop approval, and succeeds by exploiting Rovo's URL retrieval tool.

This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.

PromptArmor disclosed the vulnerabilities covered in this article to Atlassian on May 23rd. Atlassian assigned a case number and expressed thanks, but after multiple follow-ups by PromptArmor over more than two months, Atlassian has made no further communication, and Rovo remains vulnerable. As such, we are publishing to inform users of the risks.

The Attack Chain

1. The victim prepares a query asking Rovo to organize Jira tickets

2. The victim uploads a file to Rovo that contains a hidden prompt injection

   For general use cases, this is quite common: a user finds a file online and uploads it to Rovo. This attack is not dependent on the injection source - other injection sources include, but are not limited to: external data in Atlassian (e.g., support tickets), web data (if search is enabled), third-party ‘connectors’, etc.

   The 'Backlog Guide' document uploaded by the user contains a concealed prompt injection.

3. The victim asks Rovo to organize their Jira tickets

4. The injection manipulates Rovo to submit Jira tickets and Confluence documents to the attacker’s website

   Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent. Here, Rovo is manipulated to append sensitive data to an attacker's URL. When Rovo calls the insecure tool to open the URL, the attacker's site logs the request, including the appended sensitive data.

   Rovo is manipulated by the injection to submit Jira and Confluence data to the attacker's URL.

   Note: This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.

   The organization-wide 'Enable web search' setting for Rovo is toggled off.

   If the user returns to the chat later, they see the agent's suggested ticket updates, but no evidence of the attack.

   If the user later reopens the chat, all evidence is gone and output appears normal.

5. The attacker views the victim’s tickets and document contents in their website logs

   The prompt injection can exfiltrate any data the agent can access in Atlassian, including any data the agent can access via ‘connectors’.

   The attacker's server logs contain the exfiltrated Jira tickets and Confluence documents.

Extra: A second exfiltration mechanism

Atlassian Rovo also renders Markdown images from AI outputs. Insecure Markdown image rendering is a well-known vector for data exfiltration via indirect prompt injection.

To see what a full attack chain looks like for insecure Markdown image rendering, here are some examples from our other research:

Responsible Disclosure

PromptArmor disclosed the vulnerabilities covered in this article to Atlassian on May 23rd. Atlassian assigned a case number and expressed thanks, but after multiple follow-ups by PromptArmor over more than two months, Atlassian has made no further communication, and Rovo remains vulnerable as of the release of this article.

Timeline

PromptArmor Threat Intelligence

Is your organization protected from AI in vendors?

PromptArmor continuously monitors across your portfolio of third party AI in vendors, skills, plugins, connectors, MCP servers, models and more.

We detect vulnerabilities and changes like this, surfacing risk before it becomes an incident.

Learn more