Atlassian Rovo Vulnerability Enables Theft of Jira and Confluence Data

Attacker-controlled instructions can make Atlassian Rovo collect Jira or Confluence data accessible to a signed-in user and send it to an external attacker-controlled server. One link-based attack path was fixed server-side by Atlassian on July 8, 2026. The source does not confirm that the separate content-borne path was later remediated.