Tata Motors iRA app flaws could let attackers impersonate car owners
VULNERABILITYCERT-Inredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
CERT-In rates four issues in Tata Motors iRA 2.0 (26.7.3 and earlier) and iRA.ev (26.7.2 and earlier) as High: CVE-2026-121144 (service credentials, API keys and tokens embedded in the app package, retrievable without login), CVE-2026-121145 (WebView URL and origin checks insufficient, exposing live bearer tokens), CVE-2026-121146 (auth tokens in development and debug logs, local access required) and CVE-2026-121147 (improper SSL certificate pinning, enabling interception of app-backend traffic). Upgrade iRA 2.0 to 26.8.2 and iRA.ev to 26.9.1; no active exploitation is reported.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update iRA 2.0 to version 26.8.2 or later.
- Update iRA.ev to version 26.9.1 or later.
- Check whether your customers or staff use these apps.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Government agencies