Multiple serious vulnerabilities discovered in Tata Motors’ mobile apps—iRA 2.0 and iRA.ev—could allow attackers to impersonate car owners and access sensitive vehicle services. The Indian cybersecurity authority CERT-In issued a high-severity advisory on November 4, 2026, detailing four specific flaws. Users running iRA 2.0 version 26.7.3 or earlier, and iRA.ev version 26.7.2 or earlier, are reportedly at risk.
Details of the Weaknesses
The most alarming flaw involves embedded credentials (CVE-2026-121144), where API keys, authorization tokens, and service account details are hardcoded inside the app package. Anyone who installs the app can extract these credentials without needing a user login. Such exposure opens the backend services to misuse, data exfiltration, or unauthorized operations.
A WebView component issue (CVE-2026-121145) stems from inadequate validation of loaded URLs and origins. This makes it possible for malicious web content, when loaded inside the app, to interact with app functionality and steal bearer authentication tokens—effectively letting an attacker act with the owner’s privileges.
CVE-2026-121146 arises from session tokens being logged during normal app operation or debugging. An adversary with local access to those logs could retrieve session tokens and gain the ability to view vehicle data or send commands that should be limited to the legitimate user.
The fourth flaw (CVE-2026-121147) is improper SSL certificate pinning. Because network security configuration is flawed, an attacker positioned to intercept communications—such as on a public Wi-Fi or via a man-in-the-middle setup—could eavesdrop or manipulate data between the app and Tata Motors’ servers.
What Is Affected & How to Protect Yourself
These vulnerabilities affect both fuel-based and electric vehicle owners who use Tata Motors’ companion apps for tasks like remote vehicle commands, health monitoring, trip status, and general status checks. Despite these risks, the advisory does not indicate that attackers have yet exploited the flaws to hijack driving controls or compromise a specific model. The impact is focused on credential theft, data access, and potential impersonation.
CERT-In’s recommended mitigation is straightforward: upgrade to versions that patch the vulnerabilities. Users should update iRA 2.0 to version 26.8.2, and iRA.ev to version 26.9.1, via the App Store or Google Play. These releases include fixes for all four shortcomings.
Security researcher Pranav Rajendran is credited with discovering the problems. The vulnerabilities reflect wider concerns in connected-car ecosystems, where risks in the mobile app layer or backend infrastructure can have significant fallout—even without direct access to the vehicle itself.
For vehicle owners, the takeaway is clear: update the apps immediately. For manufacturers and app developers, it’s another reminder that robust security must go beyond the hardware to include how credentials, communication, and logging are handled. With connected services becoming integral to modern vehicles, securing the digital entry points is just as crucial as protecting the physical ones.
