Tata Motors apps exposed four flaws that could let attackers impersonate owners

Tata Motors’ iRA 2.0 and iRA.ev mobile apps contain four security flaws that could let attackers steal credentials, impersonate car owners, and access vehicle services. India’s Computer Emergency Response Team rated the issues High severity in an advisory published on November 4, 2026. The warning covers versions already in use by petrol, diesel, and electric vehicle customers.

Mobile app weaknesses in Tata Motors connected vehicles

CERT-In says the affected releases are iRA 2.0 version 26.7.3 and earlier, along with iRA.ev version 26.7.2 and earlier. The apps provide remote vehicle commands, status checks, health monitoring, and trip information for petrol, diesel, and electric vehicles. Security researcher Pranav Rajendran reported the vulnerabilities.

Embedded credentials and tokens inside the app package

The first issue, CVE-2026-121144, centers on service account credentials, API keys, and authorization tokens that are stored inside the app package. No login is required to download the package and extract those secrets. CERT-In’s warning places this in the same category as earlier reporting on hardcoded credentials in mobile apps.

Those exposed credentials can give access to backend services and can lead to data theft or unauthorized operations. The secrets are embedded in the distributed application itself, so an attacker does not need to steal an individual owner’s password first. That makes the flaw useful for access to services before any account-specific compromise is needed.

WebView checks and live bearer tokens

CVE-2026-121145 affects WebView, the component that displays web content inside the apps. Weak checks on loaded URLs and their origins could let malicious content interact with app functions and obtain live bearer authentication tokens. With those tokens, an attacker could impersonate the connected owner.

CERT-In also lists CVE-2026-121146, where authentication tokens appear in application logs used for development and debugging. Exploitation requires local access to those logs. If an attacker retrieves the exposed session tokens, they could use them to access vehicle information and services as the affected user.

Certificate pinning and traffic interception

The fourth flaw, CVE-2026-121147, involves an improper implementation of SSL certificate pinning in the network security configuration. CERT-In says the resulting controls are ineffective. An attacker able to intercept network traffic could use the weakness to intercept or alter communication between the mobile app and its backend services.

The advisory ties these issues to a broader pattern in connected vehicle security, where mobile apps and supporting servers matter alongside vehicle hardware. It also points to earlier automotive API vulnerability research that found separate weaknesses affecting vehicle services across several manufacturers. Tata Motors is not assumed to share those specific vehicle-control impacts.

CERT-In fix guidance and limits

CERT-In advises affected users to upgrade iRA 2.0 to version 26.8.2 and iRA.ev to version 26.9.1. Its advisory links to the official Google Play and Apple App Store listings for both apps, and it says installing the recommended release is the solution for the vulnerabilities. The advisory does not report active exploitation.

It also does not identify affected vehicle models or confirm that attackers showed control over specific driving functions. Its stated risks are limited to sensitive information, user impersonation, and unauthorized data changes using an owner’s privileges. That keeps the warning centered on the documented application flaws rather than unverified claims about vehicle takeovers.