All posts
Unproven Execution

Atlassian Rovo Toggle Bypass: Unproven Execution

PromptArmor's Rovo prompt injection bypasses Atlassian's web-search toggle: the tenant admin control leaves Rovo's URL-fetch tool mounted

Securityv0 Intelligence Team OWASP: ASI05 sv0 finding: unproven_execution
atlassian rovo unproven-execution prompt-injection connector-nhi saas-agent

The Incident

On August 5, 2026, PromptArmor publicly disclosed a content-borne indirect prompt-injection flaw in Atlassian Rovo, Atlassian’s AI assistant that operates across Jira, Confluence, and third-party connectors including SharePoint, Outlook, and GitHub. No CVE has been assigned and the affected path was not on CISA’s KEV catalog as of August 8, 2026. Rovo’s exfiltration behavior triggers without a separate user approval step at exfiltration time.

The attack embeds hidden instructions — for example, one-pixel or otherwise visually suppressed text — inside a document that a user uploads to Rovo, or inside a Confluence page that Rovo later indexes. When the user issues a legitimate request such as “organize my Jira tickets,” the model reads the hidden instructions along with the ordinary content, gathers sensitive data reachable through the user’s Atlassian permissions and connector tokens, appends that data to a URL under the attacker’s control, and invokes Rovo’s own URL-retrieval tool to open the link. The attacker reads the exfiltrated data from the destination server’s logs. The exploit bypasses Atlassian’s organization-level “disable web search” control: that toggle detaches the web-search results interface but does not detach the underlying URL-retrieval tool the agent still holds and can invoke. PromptArmor first reported the issue to Atlassian on May 23, 2026, followed up on June 4 and July 29, and published on August 5, 2026; as of publication and follow-up coverage through August 8, 2026, Atlassian had not confirmed a fix for the content-borne path. A separate one-click Rovo variant (“RovoBlast,” documented by Varonis) was fixed server-side by Atlassian on July 8, 2026 — the content-borne path is distinct and remains open.

MITRE ATT&CK coverage: T1204.002 (User Execution: Malicious File), T1567 (Exfiltration Over Web Service), T1041 (Exfiltration Over C2 Channel).

The Authority Path That Failed

The identity that carried execution authority at the moment of failure was the Rovo agent instance running inside the authenticated user’s session. The scope it held was the union of two capability sets: the user’s own Atlassian permissions across Jira and Confluence, and the OAuth/connector tokens the tenant had delegated to Rovo for SharePoint, Outlook, and GitHub. Those connector tokens are non-human identities that flow into the agent’s reach by tenant configuration, not by any explicit per-turn consent. Rovo also held tool-call authority over an internal URL-retrieval tool used to open external links surfaced during a session.

The scope Rovo exercised diverged from operator intent along one specific and inspectable axis. The Atlassian tenant admin has a control labeled “disable web search,” which operators reasonably read as revoking Rovo’s ability to reach the internet. In practice, PromptArmor’s proof-of-concept demonstrates that with the toggle set to disabled, Rovo will still fetch an attacker-controlled URL that its own reasoning trace produced after ingesting hidden instructions. The trust anchor that failed first was the operator control surface itself: an admin toggle whose label describes a user-facing capability was not aligned with the underlying tool inventory the agent could still call. The gap between “held tools” and “operator-authorized capabilities” is the surface the injection weaponizes, and it is inspectable pre-incident by comparing labeled controls against the actual mounted-tools graph.

SecurityV0 Perspective

Rovo exposes a control-plane gap: the operator disabled a named capability, but the agent retained the underlying tool needed to exercise it. The security question is not whether “web search” appears off in the admin console. It is whether any tool still mounted on the agent can reach an external URL while processing untrusted content.

Security teams need an inventory that connects each agent tool to its effective network access, connector identities, and admin controls. They also need turn-level records showing which untrusted content entered the context, which connector data was available, and which external URLs the agent opened. Without that evidence, the tenant cannot verify that a revoked capability is actually absent or reconstruct the blast radius after an incident.

What To Do

  • Audit Rovo’s actual tool graph against your admin controls. For every tenant-level toggle labeled with a user-facing capability (“web search,” “external links,” “browsing”), enumerate the underlying tools the agent still holds when that toggle is disabled. Treat any residual network-egress tool that is not gated by a labeled operator control as an authorized-in-name-only capability, and either disable Rovo for content-ingesting workflows or restrict connector scopes until Atlassian confirms a fix for the content-borne path.
  • Constrain Rovo’s connector NHIs to the minimum needed. SharePoint, Outlook, and GitHub OAuth tokens delegated to Rovo become part of every agent turn’s blast radius. Remove any connector whose read scope exceeds the workflow the tenant actually uses Rovo for; revoke tokens for connectors that are enabled but unused. Do not rely on connector-side permissions alone — the exfiltration path is the URL tool, not the connector’s API.
  • Log every Rovo URL-retrieval call and treat outbound domains as the primary signal. Capture the tuple (session ID, turn ID, ingested document IDs, outbound URL host and path, connector data present in context). Alert when a single turn ingests untrusted content and issues an outbound fetch to a host that is not on a tenant allowlist, or when the outbound path length or query-string size grows unusually large — those are the shapes an appended-payload exfiltration takes.
  • Treat any uploaded document or newly-indexed Confluence page as untrusted instruction content. Do not permit Rovo to act on those artifacts in the same session that also holds connector NHIs with write or broad-read scope. If your workflow requires both, split it across two agent surfaces with distinct tool inventories.
  • Rehearse the operator-toggle-versus-tool-inventory drill. Static permission audits will miss this class — the tenant admin’s toggle is set, and the CVE process has not tagged an ID. Drive a red-team pass that uploads a document containing hidden instructions with the “disable web search” toggle set, and verify whether an outbound URL fetch is observed. If it is, treat the disparity between the toggle’s label and the observed behavior as an incident, not a configuration nit.

Sources

All posts