The Indian Computer Emergency Response Team (CERT-In) has flagged multiple security vulnerabilities in specific versions of Tata Motors’ iRA 2.0 and iRA.ev connected vehicle applications. The vulnerabilities could potentially allow attackers to obtain sensitive credentials, impersonate users and gain unauthorised access to vehicle-related information and services.
CERT-In has assigned a High severity rating to the identified vulnerabilities and advised users to upgrade to the latest versions of the applications.
Which Tata Motors Apps and Versions Are Affected?
According to CERT-In’s advisory issued on November 4, 2026, the following application versions are affected:
- Tata Motors iRA 2.0: Version 26.7.3 and earlier.
- Tata Motors iRA.ev: Version 26.7.2 and earlier.
The iRA 2.0 application is designed for customers of Tata Motors’ internal combustion engine (ICE) vehicles, while iRA.ev serves electric vehicle customers.
Both applications provide connected vehicle features, including remote vehicle commands, vehicle status updates, health monitoring and trip information.
Four Security Vulnerabilities Identified
CERT-In has identified four vulnerabilities involving credential storage, application configuration, authentication token handling and network security.
The first vulnerability involves hardcoded service account credentials, API keys and authorisation tokens embedded within the application packages. An unauthenticated remote attacker could extract these credentials and potentially gain access to associated backend services.
The second issue relates to insufficient validation of URLs and origins loaded through the applications’ WebView component. Malicious web content could potentially expose live authentication tokens, allowing attackers to impersonate users and access connected vehicle services.
The third vulnerability concerns authentication tokens being recorded in application logs used for development and debugging. A local attacker with access to these logs could retrieve and misuse session tokens.
The fourth issue involves improper implementation of SSL certificate pinning. This could allow an attacker positioned to intercept network traffic to monitor or modify communications between the applications and their backend services.
CERT-In Recommends Immediate App Updates
CERT-In has advised users to upgrade to the following versions:
- iRA 2.0: Version 26.8.2.
- iRA.ev: Version 26.9.1.
Tata Motors Passenger Vehicles has stated that the vulnerabilities have already been addressed through software updates and enhanced security measures.
According to the company, mandatory updates were rolled out in August and September 2026, respectively. The updates are automatically prompted when users open the applications and can be completed over the air within a few minutes.
The company also stated that the update rollout has been completed for all active users and that it is contacting remaining customers who have not yet updated their applications.
Tata Motors Says No Customer Data Compromise Detected
Responding to the security advisory, Tata Motors said its assessment found no evidence of unauthorised access to or compromise of customer credentials, personal information or vehicle-related data.
The company added that it continues to monitor its systems and strengthen security measures to protect connected vehicle services and customer information.
Summary
CERT-In has flagged four high-severity security vulnerabilities in older versions of Tata Motors’ iRA 2.0 and iRA.ev applications. The issues could expose credentials, authentication tokens and connected vehicle services to unauthorised access. Tata Motors says the vulnerabilities have been addressed through updates and that it has found no evidence of customer data compromise. Users should ensure they are running the recommended app versions.
