Atlassian Rovo Prompt Injection Exfiltrates Jira and Confluence Data Without User Approval

RovoBlast is a one-click prompt-injection vulnerability in Atlassian Rovo that could allow attackers to exfiltrate sensitive enterprise data from Jira, Confluence, SharePoint, and other connected services. Atlassian addressed the reported URL-based issue on the server side after responsible disclosure, with the fix deployed on July 8, 2026. Rovo is Atlassian’s enterprise AI assistant, designed to […]

This article has been indexed from Cyber Security News

Read the original article: