Security Flaws Exposed in Tata Motors Connected Vehicle Apps
AI-generated image · Bay Street Wire
CERT-In warns of high-severity vulnerabilities in iRA and iRA.ev applications that could allow unauthorized vehicle access.
As CERT-In first reported, the Indian Computer Emergency Response Team (CERT-In) has issued a high-severity warning regarding multiple vulnerabilities found in Tata Motors' connected vehicle applications. The flaws affect iRA 2.0 (versions 26.7.3 and below) and iRA.ev (versions 26.7.2 and below), which are used by internal combustion engine and electric vehicle customers for health monitoring, trip information, and remote vehicle commands.
According to CERT-In, the vulnerabilities—reported by Pranav Rajendran—include:
* **Hardcoded Credentials (CVE-2026-121144):** The presence of API keys, authorization tokens, and service account credentials within the app package could allow remote attackers to access backend services. * **Insecure Configuration (CVE-2026-121145):** Insufficient validation of URLs in the WebView component could enable attackers to obtain live bearer authentication tokens and impersonate users. * **Information Disclosure (CVE-2026-121146):** The recording of authentication tokens in development and debugging logs could allow local attackers to hijack user sessions. * **Security Misconfiguration (CVE-2026-121147):** Ineffective SSL certificate pinning could allow attackers to intercept or modify traffic between the application and backend services.
CERT-In notes that these flaws create risks of unauthorized data modification, user impersonation, and access to sensitive vehicle information. To mitigate these risks, Tata Motors has released updates; users are advised to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1.