Disclosed vulnerability
RovoBlast: one-click prompt injection into Atlassian Rovo Chat via the rovoChatPrompt URL parameter
AIR-2026-0176 AIR record · 2026-08-atlassian-rovoblast
From the supporting source
Rovo Chat could be reached through a URL containing a parameter named `rovoChatPrompt`, which, when present, pre-loaded its contents directly into the chat interface as if the signed-in user had typed it.securityweek.com
The record
Disclosed
2026-08
Vendor
Atlassian
Product
Atlassian Rovo
Risk domain
Privacy › Data exfiltration channels
System type
Generative model
Who acted
Agent acted — Rovo executed the URL-parameter prompt and exfiltrated
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Url parameter prompt injection
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Rovo users signed in to Atlassian Cloud; reachable data spanned Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, databases, uploaded files and web pages
Capability abused
Defense & remediation
Recorded defense
none on the rovoChatPrompt parameter
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
Atlassian fixed the rovoChatPrompt parameter server-side on 2026-07-08, ahead of publication
Taxonomy & references
Curator notes
Varonis Threat Labs, presented at DEF CON 34 (August 2026); disclosed through Bugcrowd and fixed before publication. date_disclosed is left null because sources give only 'August 2026' for the public write-up and no source gives an exact day; the CSA research note dates its analysis 2026-08-14. Varonis's own blog post is not used as the source here, so SecurityWeek plus the Cloud Security Alliance research note are used. No CVE assigned. Pairs with the concurrent PromptArmor Rovo finding (2026-08-atlassian-rovo-exfiltration). | date_disclosed is recorded to the month only; no source establishes the exact day.
Supporting sources
Cite as
Enkrypt AI. "RovoBlast: one-click prompt injection into Atlassian Rovo Chat via the rovoChatPrompt URL parameter". AIR, AIR-2026-0176. https://agentincident.vercel.app/i/AIR-2026-0176/ (accessed 2026-10-19).