Full Daily Digest

The RovoBlast vulnerability exploited a URL parameter (rovoChatPrompt) to inject attacker-controlled instructions directly into Rovo’s chat session, bypassing traditional security measures. This parameter-to-prompt (P2P) injection mirrors earlier findings in Microsoft Copilot. The attack’s impact was severe due to Rovo’s integration with multiple enterprise tools and its autonomous ResearchAgent feature, which could retrieve and leak internal data. Mitigations include limiting Rovo’s access to sensitive systems, disabling unused integrations, and monitoring AI activity logs. The flaw highlights the broader industry challenge of securing AI systems against prompt injection attacks.

SecurityWeek · 2026-08-08 · Vulnerability: Atlassian’s Rovo AI had a one-click flaw allowing data exfiltration via malicious URL prompts.

The vulnerability in Atlassian's Rovo assistant stems from its susceptibility to indirect prompt injection attacks, where attacker-controlled instructions embedded in content or links manipulate the assistant's behavior. PromptArmor demonstrated that uploading a file with concealed instructions could trigger Rovo to gather internal data and exfiltrate it via URL requests, bypassing web-search restrictions. Varonis Threat Labs exploited the rovoChatPrompt URL parameter, enabling preloaded attacker instructions to execute with user privileges upon a single click. While the link-based flaw (RovoBlast) was patched server-side, the content-borne vector remains unaddressed. This exploit underscores the risks of AI assistants with broad permissions, as attackers can exfiltrate data accessible to authenticated users without explicit authorization. Mitigation requires organizations to restrict Rovo access, tighten underlying permissions, and avoid relying solely on web-search toggles as security boundaries.

The Hacker News · 2026-08-08 · Vulnerability: Atlassian's Rovo assistant can be tricked into exfiltrating Jira and Confluence data via indirect prompt injection attacks.

The research highlights two primary attack paths: exploiting permitted HTML/CSS features and creating discrepancies between sanitizer approvals and browser behavior. For instance, Outlook's label elements and custom attributes can trigger controls outside the message, while media-query parsing tricks enable arbitrary CSS injection. Gmail's image-set() fallback can exfiltrate Slack tokens via indirect prompt injection, and Fastmail's CSS hotwiring redirects clicks into unintended UI actions. Affected scope spans major providers, with some vulnerabilities already patched (e.g., Fastmail's CSS mutation bugs) and others still active (e.g., Outlook label-jacking). Mitigations include sandboxing HTML email in iframes, enforcing strict CSS allow lists, and blocking dangerous selectors and image requests. The findings underscore the need for robust email content isolation to prevent boundary-crossing attacks.

The Hacker News · 2026-08-08 · Vulnerability: CSS attacks bypass webmail defenses to steal passwords and tokens across major email providers.

The Metabase zero-day exploit leverages SQL injection to bypass authentication, granting attackers full administrative control. This enables them to manipulate configurations, steal credentials, and access sensitive data. The attack path involves exploiting the '/api/session/reset_password' endpoint, followed by querying '/api/user/current' to confirm access. Affected versions range from 1.58.0 to 1.63.3, with patches available for each. Immediate mitigation steps include updating to the latest version, blocking the vulnerable endpoint, and reviewing logs for IoCs. Organizations should also rotate credentials and audit administrator accounts. The exploit's severity underscores the importance of timely patch management and robust access controls.

The Hacker News · 2026-08-08 · Vulnerability: A zero-day vulnerability in Metabase allows unauthenticated attackers to gain admin access via SQL injection.

The vulnerability in Progress Kemp LoadMaster stems from improper input sanitization in the 'escape_quotes()' function, allowing command injection via unsanitized user input. Attackers can exploit this without credentials, leading to arbitrary code execution. The widespread exploitation attempts (792 from 65 IPs) highlight its attractiveness to threat actors. Mitigation requires immediate patching, network segmentation, and monitoring for suspicious activity from known malicious IPs. Organizations should also review logs for exploitation attempts and consider disabling vulnerable endpoints if patching isn't immediately feasible.

The Hacker News · 2026-08-08 · Vulnerability: Critical LoadMaster flaw (CVE-2026-8037) exploited in the wild, enabling unauthenticated RCE; CISA mandates patching by August 10, 2026.