India’s national cyber agency told Tata Motors owners on November 4 to update two connected-car apps, after finding four high-severity flaws that let an outsider act as the person holding the phone.
The advisory covers iRA 2.0 up to build 26.7.3 and the electric-car version iRA.ev up to 26.7.2. Both apps issue remote commands, report vehicle health and hold trip history.
Credentials that never needed stealing
The most serious issue, CVE-2026-121144, rated 8.8, is a hardcoded-credential bug: service account logins, API keys and authorization tokens sit inside the app package itself. Anyone who downloads the file can unpack it and walk away with backend access, no password required.
CVE-2026-121145 lives in the embedded WebView. Missing origin checks on loaded pages let hostile content reach live bearer tokens, which can then be replayed as the owner.
A third bug, CVE-2026-121146, writes session tokens into development logs, exposing them to anyone with local access. The fourth, CVE-2026-121147, leaves SSL certificate pinning effectively broken, so a network interceptor can read or alter app-to-server traffic.
What the agency did not claim
CERT-In named researcher Pranav Rajendran as the reporter and published no evidence of exploitation, no affected models and no demonstration of driving controls being seized. The documented risk is impersonation, data theft and unauthorized changes made with an owner’s privileges.
CERT-In lists build 26.8.2 for iRA 2.0 and 26.9.1 for iRA.ev as the fix, with no interim workaround offered. Tata Motors told ET Auto the issues were addressed through updates and that customer data is safe.
The pattern is familiar from earlier connected-vehicle API research: the phone app and its backend, not the wiring harness, now carry an owner’s authority. A copied build of that app is a credential store.
