CERT-In flags four flaws in Tata Motors iRA connected-car apps that let attackers impersonate owners

What happened

• 4 November 2026: India’s CERT-In issued vulnerability note CIVN-2026-0537, “Multiple Vulnerabilities in Tata Motors iRA and iRA.ev Application,” rated HIGH severity; the note was last updated 6 November 2026 (CERT-In).
• The affected apps are Tata Motors’ connected-vehicle apps for petrol, diesel and electric vehicles, which provide remote vehicle commands, status checks, health monitoring and trip information (Cyber Security News).
• Affected versions: iRA 2.0 version 26.7.3 and earlier, and iRA.ev version 26.7.2 and earlier (CERT-In; Cyber Security News).
• The flaws were reported by researcher Pranav Rajendran (CERT-In; Cyber Security News).
• CERT-In frames the overall risk as unauthorized access to sensitive information, user impersonation, and unauthorized modification of application data (CERT-In).
• The advisory reports no active exploitation; it does not identify affected vehicle models or confirm that attackers demonstrated control over specific driving functions (Cyber Security News).

The vulnerabilities

CERT-In lists four CVEs (CERT-In; Cyber Security News):

• CVE-2026-121144, Hardcoded credentials. Service account credentials, API keys and authorization tokens are embedded in the app package. An unauthenticated attacker can download the package and extract them, gaining access to backend services, data theft or unauthorized operations.
• CVE-2026-121145, WebView insecure configuration. Insufficient validation of URLs and origins loaded in the WebView component could let malicious web content interact with app functions and obtain live bearer tokens, which an attacker could use to impersonate the owner.
• CVE-2026-121146, Information disclosure via logs. Authentication tokens are recorded in application logs used for development and debugging. A local attacker with access to those logs could retrieve session tokens and access vehicle information and services as the affected user.
• CVE-2026-121147, Improper SSL certificate pinning. Certificate pinning is improperly implemented in the network security configuration, leaving the controls ineffective; an attacker positioned to intercept traffic could read or modify communications between the app and its backend.

Reporting on CERT-In’s note, coverage summarised the practical effect as an attacker being able to pull login credentials, bypass authorization layers to reach core telematics functions, and impersonate vehicle owners to use services linked to a vehicle (The420.in).

What to do

1. Update the apps. Upgrade to iRA 2.0 version 26.8.2 or iRA.ev version 26.9.1; CERT-In links to the official Google Play and App Store listings (CERT-In; Cyber Security News).
2. Do not run outdated builds. CERT-In advises installing the latest versions, warning that older builds may remain exposed to the known flaws (The420.in).

Tata Motors said on 5 November 2026 that “all identified issues have been remediated through software updates rolled out across August and September 2026,” and that, based on internal evaluations, “customer data and related vehicle information remained secure throughout the process” (The420.in).

Sources

• CERT-In: CIVN-2026-0537, Multiple Vulnerabilities in Tata Motors iRA and iRA.ev Application (4 November 2026)
• Cyber Security News: Tata Motors iRA App Flaws Could Let Hackers Impersonate Car Owners and Access Vehicle Services (5 November 2026)
• The420.in: CERT-In Flags Four Critical Vulnerabilities in Tata Motors Connected Car Apps (6 November 2026)