BREAKING

CERT-In warns of security flaws in Tata Motors iRA connected vehicle apps

Cyber agency warns hardcoded credentials and token logging in iRA 2.0 and iRA.ev apps could let attackers impersonate users and access backend services.

By KaroStartup News Engine

Security flaw flagged in Tata Motors connected vehicle apps

The Indian Computer Emergency Response Team (CERT-In) has issued a cybersecurity advisory warning of multiple security vulnerabilities in Tata Motors’ mobile applications, iRA 2.0 and iRA.ev, which could allow attackers to extract sensitive data, impersonate users, and access backend vehicle services.

According to CERT-In, the national nodal agency for responding to cybersecurity incidents, the vulnerabilities stem from flawed authorization controls, hardcoded service credentials, unvalidated WebView components, and exposed session tokens in development logs.

Tata Motors Passenger Vehicles stated in response that all identified vulnerabilities have already been addressed through software updates rolled out in August and September 2026, with no evidence that customer data or vehicle systems were compromised.

How the vulnerabilities put vehicle data at risk

CERT-In detailed four primary security flaws across the iRA 2.0 and iRA.ev mobile applications:

1. Hardcoded Credentials and API Keys: The application packages contained embedded service account credentials, API keys, and authorization tokens. An unauthenticated remote attacker could download the application package, extract this information, and gain unauthorized access to associated backend services to perform unauthorized operations.

2. Insufficient WebView Validation: The apps failed to properly validate URLs and origins loaded inside their WebView components. A remote attacker sending malicious web content to an affected WebView could interact with application features, obtain live bearer authentication tokens, and impersonate the user to access vehicle-related information and services.

3. Session Token Exposure in Logs: The iRA 2.0 and iRA.ev apps recorded authentication tokens in application logs used during development and debugging. A local attacker with access to system logs could retrieve these exposed session tokens to hijack user accounts.

4. Weak SSL Certificate Pinning: Improper implementation of SSL certificate pinning in the network security configuration meant an attacker positioned to intercept network traffic could execute man-in-the-middle attacks to intercept or alter communications between the application and Tata Motors' backend systems.

Patch details and app updates

CERT-In advised all Tata Motors vehicle owners to immediately update their mobile applications to the latest patched releases.

Tata Motors Passenger Vehicles confirmed that mandatory over-the-air (OTA) updates were deployed across both platforms prior to the advisory.

"In line with CERT-In’s advisory, mandatory updates to the latest versions – iRA 2.0 (version 26.8.2) and iRA.ev (version 26.9.1) – were rolled out in August and September 2026, respectively," a Tata Motors spokesperson said. "These updates are automatically prompted when users open the respective applications and can be completed over the air within a few minutes."

Why it matters for EV owners and OEMs

For automotive original equipment manufacturers (OEMs) and electric vehicle fleets, mobile app security is integral to physical safety and operational integrity. Modern connected car applications interface directly with telemetry, remote locking mechanisms, diagnostics, and charging infrastructure.

Exposed authentication tokens or hardcoded API keys in connected vehicle software create direct vectors for data leaks and unauthorized remote interactions. CERT-In's advisory highlights the operational risk when debugging practices—such as active token logging and static credentials—make their way into public production builds.

What happens next for Tata Motors users

Tata Motors reported that the rollout has been completed for all active users on both iRA 2.0 and iRA.ev platforms. The automaker said it is proactively reaching out to remaining inactive customers who have not yet completed the updates.

"Our assessment has indicated customer data and vehicle-related information remain secure – with no evidence of any unauthorised access to or compromise of customer credentials, personal information or vehicle-related data," the company spokesperson added.

The automaker stated that it continues to actively monitor its backend systems to protect customer data.