Tata Motors users have been advised to update the company’s iRA 2.0 and iRA.ev mobile applications after the Indian Computer Emergency Response Team (CERT-In) identified vulnerabilities that could allow attackers to extract embedded credentials, intercept communications and access vehicle-related services.
In an advisory, CERT-In said the applications contained hardcoded service account credentials, API keys and authorisation tokens within their packages. An unauthenticated remote attacker could download an application package, extract the embedded information and potentially gain unauthorised access to associated backend services, the agency said.
CERT-In also flagged insufficient validation of URLs and origins loaded through the applications’ WebView component. Malicious web content sent to the affected WebView could enable unauthorised interaction with application functionality, expose live bearer authentication tokens and potentially allow an attacker to impersonate a user and access vehicle-related information and services, according to the advisory.
The agency identified additional risks linked to authentication tokens recorded in application logs used for development and debugging. A local attacker with access to those logs could retrieve and misuse session tokens, potentially impersonating the associated user and gaining unauthorised access to vehicle-related information and services.
CERT-In further said the applications had an improper implementation of SSL certificate pinning in their network security configuration. This made the pinning controls ineffective and could allow an attacker positioned to intercept network traffic to modify communications between the applications and Tata Motors’ backend services.
The agency has advised users to update iRA 2.0 to version 26.8.2 and iRA.ev to version 26.9.1. Tata Motors Passenger Vehicles said the vulnerabilities had been addressed through software updates and enhanced security measures. According to a company spokesperson cited by BusinessLine, the mandatory updates were rolled out for iRA 2.0 in August and iRA.ev in September 2026.
The company said the updates are automatically prompted when users open the respective applications and can be completed over the air within a few minutes. It added that the update rollout had been completed for all active users, while it was contacting remaining customers who had not yet completed the process.
Tata Motors said its assessment had found no evidence of unauthorised access to or compromise of customer credentials, personal information or vehicle-related data. The company also said it was continuing to monitor its systems. The advisory and company response underline the growing security responsibility attached to connected-vehicle applications, which link mobile users with backend systems and vehicle-related services.
Users of the affected applications should complete the updates to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1, as advised by CERT-In and Tata Motors.
