Tata Motors’ iRA 2.0 and iRA.ev apps, used for vehicle management, have been identified as containing critical security vulnerabilities. The Indian Computer Emergency Response Team (CERT-In) has issued a high-severity warning regarding these flaws, which were reported on November 4, 2026.
Security Threats Identified
The affected app versions include iRA 2.0 up to 26.7.3 and iRA.ev up to 26.7.2. These applications facilitate remote commands, status updates, and vehicle health monitoring for both traditional and electric vehicles. Security researcher Pranav Rajendran has been credited with uncovering these vulnerabilities.
The primary vulnerability, labeled CVE-2026-121144, involves insecure storage of crucial credentials within the app. Attackers can potentially access these credentials without requiring any login information, posing significant risks of unauthorized access to backend services.
Further Vulnerabilities and Risks
Another significant vulnerability, CVE-2026-121145, involves the WebView component, which improperly handles URL origins. This flaw allows malicious content to access authentication tokens, enabling attackers to impersonate legitimate users.
CVE-2026-121146 relates to authentication tokens being exposed through application logs intended for development. While local access is required to exploit this vulnerability, it still poses significant risks if exploited.
The fourth flaw, CVE-2026-121147, is due to ineffective SSL certificate pinning, making the app susceptible to data interception by attackers who can manipulate network communications.
Recommended Actions and Updates
CERT-In recommends users update their apps to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 to mitigate these vulnerabilities. The advisory directs users to official app stores for these updates.
No evidence of active exploitation or impact on specific vehicle models has been reported. However, the advisory highlights the importance of addressing these vulnerabilities to protect users from potential data breaches and impersonation risks.
The findings underscore the critical nature of mobile app security in the realm of connected vehicles, emphasizing the necessity for regular updates and vigilance in cybersecurity practices.
