Technology1 min read

Hardcoded credentials and other issues in Tata Motors App

By · Published by Everything Blog

In short

The flaws affect multiple older versions of the iRA 2.0 and iRA.ev applications across both electric and combustion engine vehicles. Vulnerabilities span hardcoded secrets, session token logging in debugging files, exposed live tokens via WebView, and improper SSL certificate pinning. These flaws enable unauthorized individuals to intercept network traffic and obtain sensitive credentials. To eliminate the threats, users are instructed to update their mobile applications to newly patched releases.

Key points

  • Cybersecurity researcher Pranav Rajendran discovered and reported the critical mobile app…: Cybersecurity researcher Pranav Rajendran discovered and reported the critical mobile application vulnerabilities.
  • CERT-In issued an official advisory directing motorists to immediately update their conne…: CERT-In issued an official advisory directing motorists to immediately update their connected vehicle apps.
  • Users must upgrade to iRA 2.0 version 26.8.2 or iRA.ev version 26.9.1 to mitigate these s…: Users must upgrade to iRA 2.0 version 26.8.2 or iRA.ev version 26.9.1 to mitigate these security risks.

Sources checked by our analysis pipeline: 1

CERT-In Vulnerability Note

CIVN-2026-0537

Multiple Vulnerabilities in Tata Motors iRA and iRA.ev Application

Original Issue Date:November 04, 2026

Severity Rating: HIGH

Systems Affected

- Tata Motors iRA 2.0 versions 26.7.3 and below

- Tata Motors iRA.ev versions 26.7.2 and below

Overview

Multiple vulnerabilities have been reported in Tata Motors iRA and iRA.ev applications, which could allow an attacker to obtain sensitive credentials or access to vehicle related information and services.

Target Audience: Users of the affected iRA 2.0 and iRA.ev mobile applications.

Risk Assessment: Risk of unauthorized access to sensitive information, user impersonation and unauthorized modification of application data.

Impact Assessment: Potential for unauthorized access and modification of data with the privileges of the impersonated user.

Description

The iRA 2.0 and iRA.ev mobile applications are Tata Motors connected vehicle applications for internal combustion engine (ICE) and electric vehicle (EV) customers, respectively. They provide access to vehicle related information and connected services, including remote vehicle commands, vehicle status and health monitoring and trip information.

1. Hardcoded Credentials Vulnerability

(

CVE-2026-121144

)

This vulnerability exists in the iRA 2.0 and iRA.ev mobile…

Technology

More in Technology