Tata Motors iRA apps: CERT-In details four security flaws; company says fixes were rolled out

What Happened

India's Computer Emergency Response Team (CERT-In) issued vulnerability note CIVN-2026-0537 on November 4, 2026, identifying four security weaknesses in older releases of Tata Motors' iRA 2.0 and iRA.ev connected-vehicle mobile applications. CERT-In assigned the combined advisory a HIGH severity rating. Its findings describe ways an attacker might access sensitive credentials, impersonate app users or interfere with communications between the app and associated services.

The applications support connected-car services for Tata Motors internal-combustion and electric-vehicle owners. Their functions include vehicle status, health and trip information and certain remote vehicle commands. That makes account security and the integrity of communication with backend services important: an attacker who can misuse a legitimate app session might reach information and functions available to that account.

On November 5, Tata Motors Passenger Vehicles said it had addressed the weaknesses through software updates and other security changes. The company said its own assessment found no evidence that customer credentials, personal information or vehicle-related data had been accessed without authorisation. That is the company's reported assessment, not independent forensic confirmation.

Four Cves And Their Security Impact

CVE-2026-121144 concerns hardcoded credentials. CERT-In says service-account credentials, API keys or authorisation tokens were included in the downloadable application package. An attacker with a copy of that package could potentially extract sensitive values and attempt unauthorised access to connected backend services. Embedding reusable secrets inside an app distributed to users creates a security risk because the app package is not inherently confidential.

CVE-2026-121145 involves insufficient URL and origin validation in a WebView, a component used to display web content within a mobile app. Malicious content loaded under vulnerable conditions might interact with app features, expose live bearer authentication tokens or enable user impersonation. The conditions described do not mean that opening any normal page automatically compromises a user.

CVE-2026-121146 concerns authentication tokens recorded in debugging or development logs. CERT-In describes this as a local attack opportunity for a person or process able to access the logs. If a valid token can be recovered and reused, account-related vehicle information or services could potentially be accessed as that user. Log access is a material prerequisite and should not be omitted from descriptions of the weakness.

CVE-2026-121147 concerns ineffective SSL certificate pinning. Certificate pinning is an additional mechanism intended to help an app recognise the expected server identity. Improper implementation can reduce protection against an attacker able to intercept traffic between an affected app and its services. CERT-In warns of possible interception or modification of communications under those conditions.

A vulnerability description explains a potential route of attack. It is not proof of a successful compromise, an identified victim or a practical way to take control of a vehicle's driving systems.

Affected Application Versions And Patch Guidance

CERT-In lists iRA 2.0 version 26.7.3 and earlier, and iRA.ev version 26.7.2 and earlier, as affected. It recommends upgrading iRA 2.0 to version 26.8.2 and iRA.ev to version 26.9.1. These are the versions named in the November 4 advisory, not a permanent claim that they remain the newest releases.

Customers should use their official Android or iOS application store to check for a current update and confirm their app is running the specified fixed release or a later supported version. Users should not download unofficial modified application packages or provide passwords or one-time codes to people claiming to be performing a security update.

The Company's Response

Tata Motors Passenger Vehicles told news outlets that it had rolled out mandatory security updates in August 2026 for iRA 2.0 and September 2026 for iRA.ev. It said active users had completed the update process, while it was contacting remaining customers who had not yet updated their apps.

The response provides useful context for the timing of CERT-In's later public advisory. The disclosure date does not necessarily mean that fixes became available on the same day. It also does not guarantee that every device had installed a fixed release; update compliance depends on the individual app installation.

Why The Findings Matter

Connected-vehicle software brings together mobile identity, backend APIs and vehicle-linked information. A flaw affecting account credentials or session tokens can potentially expose sensitive information or allow actions using a legitimate user's privileges. However, the advisory concerns mobile applications and associated services. It does not establish an exploit against steering, braking or other vehicle-control systems.

The findings illustrate broader software-security principles: avoid placing reusable secrets in distributable apps; minimise the exposure of authentication tokens in logs; restrict untrusted content in embedded web interfaces; and correctly implement transport-security validation. For connected services, service providers also need controls on their backend APIs, not just checks in the mobile application.

Practical Actions For Owners And Fleet Operators

Individual vehicle owners should check for official iRA updates, investigate unfamiliar account activity and use established Tata Motors support channels if they need assistance. These precautions are sensible even when there is no evidence their own account has been affected. Password and account reviews may be appropriate if unusual access is detected, but the advisory does not require assuming all passwords have been stolen.

Fleet operators and organisations using connected-vehicle services should inventory installed application versions, confirm update rollout, and use account-access and support records to investigate anomalies. Where updates are centrally managed, maintain evidence of compliance and a plan to contact users who are still running older releases.

What Remains Unconfirmed

CERT-In documented four vulnerabilities and their potential consequences; Tata Motors said it had addressed them and found no evidence of a customer-data compromise in its assessment. The reviewed reporting does not independently establish an active exploitation campaign, the number of compromised accounts, theft of vehicle telemetry or unauthorised control of a moving car.

CyberGeek News will treat any later confirmed security incident as a separate development requiring fresh evidence. Security researcher Pranav Rajendran is credited by CERT-In for reporting the vulnerabilities.