Four Vulnerabilities in Tata Motors' iRA Apps Allow Owner Impersonation and Data Theft
High-severity flaws in Tata Motors' iRA 2.0 and iRA.ev mobile applications could enable attackers to steal credentials, impersonate vehicle owners, and access connected car services.
Four critical vulnerabilities have been discovered in Tata Motors' iRA 2.0 and iRA.ev mobile applications, potentially allowing threat actors to compromise vehicle owner accounts and access sensitive services. India's Computer Emergency Response Team (CERT-In) rated these flaws as High severity, highlighting the risks to users of Tata's connected vehicle technology. The affected versions include iRA 2.0 prior to v26.7.3 and iRA.ev prior to v26.7.2. These applications are integral to the user experience for Tata's petrol, diesel, and electric vehicle owners, offering features such as remote vehicle commands, status monitoring, and trip data.
The first vulnerability, identified as CVE-2026-121144, stems from the insecure storage of sensitive information directly within the app package. This includes embedded credentials, API keys, and authorization tokens. Attackers can extract these secrets without needing to compromise a specific user's account, simply by obtaining the app package. This practice of hardcoding credentials in mobile applications has been a recurring security concern, as it provides a direct pathway to backend services and potential data exfiltration or unauthorized operations.
Further complicating security, CVE-2026-121145 exploits the way the apps handle web content through the WebView component. Insufficient validation of loaded URLs and their origins could permit malicious content to interact with app functionalities, leading to the theft of live bearer authentication tokens. These stolen tokens can then be misused by attackers to impersonate legitimate vehicle owners and access their connected services.
Another significant flaw, CVE-2026-121146, involves the exposure of authentication tokens through application logs. These logs, often used for debugging and development purposes, can inadvertently reveal session tokens if an attacker gains local access to the device. Once obtained, these tokens can be leveraged to access vehicle information and perform actions as the affected user, bypassing standard authentication mechanisms.
The fourth vulnerability, CVE-2026-121147, concerns an inadequate implementation of SSL certificate pinning. This security measure is designed to ensure that the app communicates only with legitimate servers. However, the ineffective controls in this case could allow an attacker positioned to intercept network traffic to potentially eavesdrop on or tamper with communications between the mobile application and its backend services.
These findings underscore the critical role that mobile application security plays in the broader ecosystem of connected vehicles. The vulnerabilities highlight that the security of modern vehicles extends beyond hardware and firmware to encompass the mobile applications and server infrastructure that manage them. Previous research into automotive API vulnerabilities has shown similar risks across various manufacturers, emphasizing the need for robust security practices in this domain.
CERT-In has advised affected users to update their iRA 2.0 applications to version 26.8.2 and their iRA.ev applications to version 26.9.1. These updates are available through the official Google Play and Apple App Store. While the advisory does not indicate any reports of active exploitation or confirmed vehicle control compromises, the identified flaws pose a significant risk of sensitive data exposure, user impersonation, and unauthorized data manipulation.