Tata Motors iRA App Flaws Could Let Hackers Impersonate Car Owners and Access Vehicle Services

Tata Motors’ iRA 2.0 and iRA.ev mobile apps contain four security flaws that could let attackers steal credentials, impersonate car owners, and access vehicle services. India’s Computer Emergency Response Team, CERT-In, rated the issues as High severity in an advisory published on November 4, 2026.

The warning covers iRA 2.0 versions 26.7.3 and earlier, alongside iRA.ev versions 26.7.2 and earlier. These apps serve petrol, diesel, and electric vehicle customers, providing remote vehicle commands, status checks, health monitoring, and trip information. CERT-In credits security researcher Pranav Rajendran with reporting the vulnerabilities.

Embedded Credentials and Stolen Tokens

The first flaw, CVE-2026-121144, involves service account credentials, API keys, and authorization tokens stored inside the app package. An attacker needs no login to download the package and extract these secrets. The issue reflects risks previously covered in Cybersecurity News’ reporting on hardcoded credentials in mobile apps.

Those exposed credentials could provide access to backend services, potentially allowing data theft or unauthorized operations. This weakness matters because the sensitive information comes from the distributed application itself. An attacker would not first need to steal a particular owner’s password to extract the embedded credentials.

CVE-2026-121145 affects WebView, the component that displays web content inside the apps. Insufficient checks on loaded URLs and their origins could let malicious content interact with app functions and obtain live bearer authentication tokens. An attacker could then misuse those tokens to impersonate the associated owner.

According to CERT-In’s advisory, CVE-2026-121146 exposes authentication tokens through application logs used for development and debugging. Exploitation requires local access to those logs. An attacker who retrieves the exposed session tokens could misuse them to access vehicle information and services as the affected user.

The fourth flaw, CVE-2026-121147, involves an improper implementation of SSL certificate pinning in the network security configuration. CERT-In says the resulting controls are ineffective. An attacker positioned to intercept network traffic could exploit the weakness to intercept or change communications between the mobile application and its backend services.

The findings highlight how connected vehicle security depends on mobile apps and supporting servers, not only vehicle hardware. Earlier automotive API vulnerability research documented separate weaknesses affecting vehicle services across several manufacturers. Those findings provide context, but their specific vehicle-control impacts should not be assumed for Tata Motors.

Fixed Versions Available

CERT-In advises affected users to upgrade iRA 2.0 to version 26.8.2 and iRA.ev to version 26.9.1. Its advisory links to the official Google Play and Apple App Store listings for both applications. Installing the recommended release is the agency’s stated solution for addressing these vulnerabilities.

The advisory does not report active exploitation, identify affected vehicle models, or confirm that attackers demonstrated control over specific driving functions. Its stated risks concern sensitive information, user impersonation, and unauthorized data changes using an owner’s privileges. The distinction keeps the warning focused on documented application weaknesses rather than unverified claims about vehicle takeovers.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Tata Motors iRA App Flaws Could Let Hackers Impersonate Car Owners and Access Vehicle Services appeared first on Cyber Security News.