Tata Motors iRA 2.0 and iRA.ev apps embed credentials and tokens, exposing vehicle services

Summary

The Tata Motors iRA 2.0 and iRA.ev vehicle connection apps contain service account credentials, API keys and authorization tokens inside the app package, so anyone can download and extract them. Users of these apps are affected, and an attacker could reach vehicle information and services or impersonate users.

What to do

Update Tata Motors iRA 2.0 to 26.8.2 and iRA.ev to 26.9.1.

Update to at least the version for your product:

• Tata Motors iRA 2.0 26.8.2 or later
• Tata Motors iRA.ev 26.9.1 or later

Products and platforms

• Android
• iOS
• Tata Motors iRA.ev
• Tata Motors iRA 2.0

CVE IDs

• CVE-2026-121144 (opens in a new tab)
• CVE-2026-121145 (opens in a new tab)
• CVE-2026-121146 (opens in a new tab)
• CVE-2026-121147 (opens in a new tab)

Sources

• Write-up: cert-in.org.in (opens in a new tab)
• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-04 12:29 UTC

First seen 2026-11-09 15:20 UTC