A vulnerability has been discovered in Atlassian's AI 'Rovo' that allows internal company data to be transmitted externally simply by having it read documents.
A vulnerability has been discovered in Atlassian's AI service, 'Atlassian Rovo,' that allows for the transmission of internal data from Jira and Confluence to external sources simply by feeding it a document containing malicious commands. According to security firm PromptArmor, user authorization is not required, and the attack cannot be prevented even if the organization's administrator has disabled web search.
Atlassian Rovo Exfiltrates Data, Bypassing Controls | PromptArmor
Rovo is an AI service that searches across information stored in services such as Jira and Confluence, providing answers to questions and summarizing documents. While it makes it easier to find company information scattered across multiple services, it may be susceptible to 'indirect prompt injection,' where instructions hidden in documents received from external sources are processed as user instructions.
In the test published by PromptArmor, a user typed 'Please organize the tickets using this guide' into the Rovo chat screen and attached a PDF summarizing the Jira work procedure. The user's request itself was a typical work instruction, and it was not possible to identify any elements that could lead to an attack from the screen alone.
The attached PDF appears to be a standard operating procedure manual titled 'Jira Backlog Organization Guide.' However, hidden within the PDF were instructions written in white text on a white background, with a line spacing of 0.1 and a font size of 1 point. Even though these characters are invisible to humans, Rovo, which analyzes the entire document, can read them as instructions.
When Rovo receives a request, it first checks for outstanding tickets in Jira. The verification screen determines that there are 10 outstanding tickets in the 'KAN' project and begins searching for the Confluence page associated with each ticket.
The problem lies in what happens after the necessary information has been collected. Hidden instructions within the PDF told Robo to send Jira tickets and Confluence documents to specified external URLs. The verification screen records Robo loading multiple URLs, then determining that 'each ticket needs to be sent to an evaluation URL,' and attempting to invoke a function to open the URLs.
Even if data is sent externally, users will see the normal work results. The verification screen displays a list of tickets from KAN-10 to KAN-1, each with a summary of the organized data. From the user's perspective, it appears as if Rovo has organized the tickets as requested, making it difficult to notice that internal data has been sent in the background.
On the other hand, the attacker's access logs stored Jira ticket numbers, assignees, priority levels, and ticket summaries. Furthermore, the section labeled 'CONFLUENCE PAGES' also recorded the body of the Confluence documents that Rovo accessed. This indicates that the attacker not only accessed an external URL but also included internal company information in the URL to extract data.
Atlassian provides a setting to disable public web searches by Robo. However, this setting does not disable Robo's ability to open specified URLs, meaning an attacker can bypass it by directly generating URLs. It has also been reported that data transmission using communication that loads Markdown-formatted images is possible.
PromptArmor reported the vulnerability to Atlassian on May 23, 2026, but explained that they did not receive a detailed response until the information was made public on August 5, and stated that they are waiting for Atlassian to take action and provide guidance to users.
Related Posts:
