The Indian Computer Emergency Response Team (CERT-In) has flagged four security vulnerabilities in Tata Motors' iRA 2.0 and iRA.ev mobile apps. It has warned that the security bugs could allow attackers to access sensitive information and vehicle-related services. The agency assigned a 'High' severity rating to the vulnerabilities, which affect iRA 2.0 versions 26.7.3 and earlier, and iRA.ev versions 26.7.2 and earlier.
One of the flaws involves service account credentials, API keys and authorisation tokens embedded in the application package. An unauthenticated remote attacker could download the app, extract these credentials and potentially gain unauthorised access to backend services.
Another vulnerability stems from inadequate validation of URLs and origins loaded through the apps' WebView component. An attacker could introduce malicious web content into the affected WebView and potentially obtain active bearer authentication tokens, allowing them to impersonate the associated user.
Also read: Tata Punch.ev Becomes First Standalone EV Model To Cross 5,000 Monthly Sales
Authentication Token And Network Security Risks
CERT-In also identified an issue involving authentication tokens being stored in application logs used for development and debugging. A local attacker with access to these logs could retrieve the exposed session tokens and misuse them to impersonate users and access vehicle-related information and services.
The fourth vulnerability concerns the incorrect implementation of SSL certificate pinning in the apps' network security configuration. An attacker capable of intercepting network traffic could potentially monitor or modify communications between the applications and their backend services.
Tata Motors Rolls Out Security Updates
Tata Motors Passenger Vehicles said the vulnerabilities have been addressed through software updates and additional security measures. The automaker rolled out mandatory updates for iRA 2.0 version 26.8.2 in August 2026 and iRA.ev version 26.9.1 in September 2026.
