{
 "public_id": "AIR-2026-0176",
 "incident_id": "2026-08-atlassian-rovoblast",
 "date_disclosed": "2026-08",
 "date_occurred": null,
 "title": "RovoBlast: one-click prompt injection into Atlassian Rovo Chat via the rovoChatPrompt URL parameter",
 "class": "responsible_disclosure",
 "attack_surface": "enterprise_assistant",
 "initial_vector": "url_parameter_prompt_injection",
 "agent_capability_abused": [
  "jira_search",
  "confluence_search",
  "connector_retrieval"
 ],
 "target_product": "Atlassian Rovo",
 "target_vendor": "Atlassian",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration"
 ],
 "blast_radius": "Rovo users signed in to Atlassian Cloud; reachable data spanned Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, databases, uploaded files and web pages",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "one_click",
   "parameter_to_prompt",
   "link_lure"
  ]
 },
 "defense_present": "none on the rovoChatPrompt parameter",
 "defense_bypassed": true,
 "fix_shipped": "Atlassian fixed the rovoChatPrompt parameter server-side on 2026-07-08, ahead of publication",
 "primary_sources": [
  "https://www.securityweek.com/critical-one-click-vulnerability-in-atlassians-rovo-ai-exposed-enterprise-data/",
  "https://labs.cloudsecurityalliance.org/research/csa-research-note-atlassian-rovo-prompt-injection-20260814-c/"
 ],
 "verified_quote": "Rovo Chat could be reached through a URL containing a parameter named `rovoChatPrompt`, which, when present, pre-loaded its contents directly into the chat interface as if the signed-in user had typed it.",
 "confidence": "high",
 "notes": "Varonis Threat Labs, presented at DEF CON 34 (August 2026); disclosed through Bugcrowd and fixed before publication. date_disclosed is left null because sources give only 'August 2026' for the public write-up and no source gives an exact day; the CSA research note dates its analysis 2026-08-14. Varonis's own blog post is not used as the source here, so SecurityWeek plus the Cloud Security Alliance research note are used. No CVE assigned. Pairs with the concurrent PromptArmor Rovo finding (2026-08-atlassian-rovo-exfiltration). | date_disclosed is recorded to the month only; no source establishes the exact day.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "Data Exfiltration via Context",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Rovo executed the URL-parameter prompt and exfiltrated",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "url_parameter_prompt_injection",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [],
 "eai_reason": "subcategory: Data Exfiltration via Context",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}