Skip to content
CERT-In Warns of High-Severity Vulnerabilities in Tata Motors' iRA Apps

CERT-In Warns of High-Severity Vulnerabilities in Tata Motors' iRA Apps

First seen 5 Nov 2026, 14:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 5, 2026 at 14:17 UTC
  • •CERT-In flagged high-severity vulnerabilities in Tata Motors' iRA apps.
  • •Vulnerabilities include hardcoded credentials and improper SSL pinning.
  • •Users must upgrade to versions 26.8.2 and 26.9.1 to mitigate risks.

CERT-In has identified multiple high-severity vulnerabilities in Tata Motors' iRA 2.0 and iRA.ev mobile applications. The vulnerabilities stem from hardcoded credentials, inadequate URL validation, and improper SSL certificate pinning, allowing attackers to extract sensitive information and impersonate users. Affected versions include iRA 2.0 versions 26.7.3 and below, and iRA.ev versions 26.7.2 and below. Users are advised to upgrade to the latest versions, 26.8.2 for iRA 2.0 and 26.9.1 for iRA.ev, which were rolled out in August and September 2026. The vulnerabilities could lead to unauthorized access to vehicle-related information and services. Tata Motors has stated that the issues have been addressed through software updates and enhanced security measures.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2026-09-01
Software updates rolled out
Tata Motors rolled out mandatory updates for iRA 2.0 and iRA.ev to address identified vulnerabilities.
Tradingview
2026-11-05
CERT-In issues vulnerability advisory
CERT-In warns of multiple high-severity vulnerabilities in Tata Motors' iRA apps, affecting versions 26.7.3 and below.
Tradingview

More articles in this cluster (2)

Following this threat?

Track Tata Motors in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 3

Common questions

Which versions of the iRA apps are affected?
Tata Motors iRA 2.0 versions 26.7.3 and below, and iRA.ev versions 26.7.2 and below are affected.
What should users do to protect themselves?
Users should upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 to mitigate the vulnerabilities.
What types of attacks could these vulnerabilities enable?
The vulnerabilities could allow attackers to extract sensitive information, impersonate users, and gain unauthorized access to vehicle-related services.