"RovoBlast": A URL Parameter Prefills Atlassian Rovo With Attacker Instructions Inside an Authenticated Session

Atlassian Rovo, the enterprise AI assistant spanning Jira, Confluence, Bitbucket, and connected third-party services

Varonis Threat Labs, presenting at DEF CON 34, showed that Rovo accepted externally supplied content through the `rovoChatPrompt` URL parameter, so a link of the form `https://home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt=<prompt>` prefilled Rovo Chat with attacker-written instructions the moment a logged-in user clicked it, with no meaningful warning and nothing indicating the prompt came from outside. Exploitation required no jailbreak and no permissions bypass, because the instructions arrived inside a session that already held the user's access. In testing Rovo could reach data across Jira, Confluence, Bitbucket, Slack, Microsoft 365, Google Workspace, databases, uploaded files, and more than 50 further platforms through connectors. Varonis calls the pattern Parameter-to-Prompt, the same shape as its earlier Reprompt work against Microsoft Copilot and its later CoSnitch disclosure. Reported through Atlassian's Bugcrowd program and fixed; no CVE was assigned. Varonis also noted that Rovo cannot be fully uninstalled from a tenant

A query parameter treated as user-authored input to an assistant that acts with the viewer's full authority, with no separation between what the user typed and what a link supplied. The permission model was never bypassed; it was borrowed