Owners using Tata Motors’ iRA 2.0 and iRA.ev connected-car apps should check their installed versions following four vulnerability disclosures from India’s CERT-In. The agency’s CVE records published on November 4 identify weaknesses that could expose credentials, enable user impersonation or interfere with communications with backend services.
The affected releases are iRA 2.0 version 26.7.3 and earlier, and iRA.ev version 26.7.2 and earlier. CERT-In recommends upgrading to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1. Its records credit researcher Pranav Rajendran with reporting the vulnerabilities.
Four weaknesses with different access requirements
CVE-2026-121144, rated 8.8 under CVSS 4.0, concerns service-account credentials, API keys and authorization tokens embedded in application packages. CERT-In says an unauthenticated attacker could extract that material from a downloaded package and use it to reach associated backend services.
The second issue, CVE-2026-121145, involves insufficient checks on URLs and origins loaded by an embedded WebView. Malicious web content could obtain live bearer tokens or interact with app functionality without authorization. The record assigns it a CVSS 4.0 score of 7.1.
The remaining issues require different footholds. CVE-2026-121146, scored 6.8, exposes authentication tokens in development and debugging logs; exploitation requires local access to those logs. CVE-2026-121147, scored 8.5, concerns ineffective certificate pinning. An attacker positioned to intercept network traffic could potentially read or alter exchanges between the app and its services.
These are not interchangeable attack paths. Downloading a package, accessing local logs and intercepting traffic each impose different conditions. The disclosures describe potential access to vehicle-related information and services; they do not establish that attackers took control of vehicles or exploited the flaws in the wild.
Check the app, then the version
Tata’s store descriptions distinguish iRA 2.0 for combustion-engine customers from iRA.ev for electric-vehicle owners. Both provide connected services, so owners should verify which application they use rather than treating the two version numbers as alternatives.
The recommended releases already appear in Apple’s version histories: iRA 2.0 version 26.8.2 is dated August 28, and iRA.ev version 26.9.1 September 12. The November disclosure therefore does not mean those updates were released that day. Check the installed version after updating through the official store; the CVE records do not provide separate affected-version ranges for Android and iOS.
