CERT-In flags high-severity flaws in Tata's iRA connected-car apps — update now

India's Computer Emergency Response Team (CERT-In) has issued a high-severity advisory covering four separate vulnerabilities in Tata Motors' iRA 2.0 and iRA.ev smartphone apps — the companion apps that let owners of connected Tata vehicles check vehicle status, monitor battery or engine health, view trip data and issue remote commands. Owners running an affected version should update immediately.

What happened

CERT-In published Vulnerability Note CIVN-2026-0537 on 4 November 2026, covering Tata Motors iRA 2.0 version 26.7.3 and below, and Tata Motors iRA.ev version 26.7.2 and below. The advisory, also logged as four separate CVE entries (CVE-2026-121144 through CVE-2026-121147) with CVSS scores ranging from 6.8 (medium) to 8.8 (high), describes four distinct flaws:

1. Hardcoded credentials (CVE-2026-121144, CVSS 8.8): service account credentials, API keys and authorisation tokens are embedded directly in the app package. Anyone who downloads the app can extract these and potentially gain unauthorised access to Tata's backend services.
2. WebView origin-validation error (CVE-2026-121145, CVSS 7.1): insufficient checking of URLs loaded inside the app's in-built browser component could let an attacker serve malicious web content that extracts live authentication tokens and impersonates the user.
3. Authentication tokens logged in plaintext (CVE-2026-121146, CVSS 6.8): session tokens are written to device logs used for debugging. Anyone with local access to those logs — a repair shop, a previous owner's unwiped device, or malware on the phone — could retrieve and reuse them to impersonate the account.
4. Ineffective SSL certificate pinning (CVE-2026-121147, CVSS 8.5): the network security configuration doesn't properly enforce certificate pinning, which could let an attacker positioned on the same network intercept or alter traffic between the app and Tata's servers.

CERT-In's stated impact assessment is "potential for unauthorised access and modification of data with the privileges of the impersonated user" — in plain terms, someone exploiting these flaws could potentially view a victim's vehicle status, trip history and account data, or issue the remote commands the app supports, without the owner's knowledge. The advisory does not describe any flaw as enabling a direct bypass of the vehicle's physical locks or immobiliser.

CERT-In's fix is straightforward: update to iRA 2.0 version 26.8.2 or later, and iRA.ev version 26.9.1 or later, both available through the usual app stores. PTI reported that an email query sent to Tata Motors Passenger Vehicles on the advisory went unanswered as of publication.

What it means for an Indian buyer

If you own a connected Tata — the Nexon EV, Punch.ev, Curvv EV, Harrier EV, Tigor EV or any other Tata model paired with the iRA 2.0 or iRA.ev app — the action here is simple and low-friction: open the app store on your phone, check for a pending update to the version CERT-In names as fixed, and install it. There's no workshop visit, no VIN-specific check and no cost involved, unlike a hardware recall.

It's worth treating this as a reminder rather than a one-off: as cars get more software-defined, the attack surface shifts from the vehicle itself to the apps and backend services around it, and these flaws — hardcoded secrets, tokens logged in the clear, weak certificate pinning — are common app-security mistakes rather than anything specific to EVs or to Tata. If you're shopping for a connected car generally, it's reasonable to ask a dealer whether the brand's companion app has had any CERT-In advisories and how quickly past ones were patched, the same way you'd ask about a mechanical recall history.

The Auto Grid angle

This one sits outside what paint protection film can do anything about — PPF guards against stone chips and UV fade, not app-layer credential leaks — but it's a useful data point for anyone buying a modern connected car: the ownership experience now spans both the metal and the software stack, and keeping both current (app updates as diligently as service intervals) is part of looking after a car in 2026, alongside the physical protection a new owner typically arranges in the first week of ownership.

FAQ and what's next

Tata Motors has not issued its own public statement on this advisory as of publication, and PTI's query to the company went unanswered. We'll update this article if Tata responds, or if CERT-In issues a follow-up note on patch adoption or any further vulnerabilities in the iRA app family.