If you drive a Tata and use the Tata iRA app, update it today. India’s national cyber agency, CERT-In, has flagged four security flaws in the iRA 2.0 and iRA.ev connected vehicle apps and rated them “High” severity in vulnerability note CIVN-2026-0537. The warning says an attacker could obtain sensitive credentials or reach vehicle-related information and services.
Business Standard dates the advisory to Tuesday, while Moneycontrol and ETAuto reported it on November 4, and the story spread across Indian news on November 5. CERT-In credits researcher Pranav Rajendran with reporting the issues. According to ETAuto and CNBC-TV18, an e-mail to Tata Motors Passenger Vehicles had not been answered at the time of writing.
What has CERT-In found in the Tata iRA app?
CERT-In found four weaknesses in how the Tata iRA app stores credentials, handles web content, logs data and secures traffic. Together they create a risk of unauthorised access to sensitive information, impersonation of the owner and unauthorised changes to app data, carried out with the privileges of the impersonated user. The agency rated the overall severity “High”.
Which Tata iRA app versions are affected?
The warning covers iRA 2.0 version 26.7.3 and earlier, used by owners of petrol and diesel Tata cars, and iRA.ev version 26.7.2 and earlier, used by Tata EV owners. CERT-In advises upgrading to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1, which it lists as the fixed releases.
Checking takes less than a minute. Open the app’s page in the Play Store or App Store, or look in the app’s settings or “About” section for the version number. If it is lower than the fixed build, update.
Tata iRA app advisory at a glance
| Item | Detail |
|---|---|
| Issued by | CERT-In (Indian Computer Emergency Response Team) |
| Note number | CIVN-2026-0537 |
| Severity | High |
| Affected apps | iRA 2.0 (ICE cars) 26.7.3 and below; iRA.ev (EVs) 26.7.2 and below |
| Fixed versions | iRA 2.0 26.8.2; iRA.ev 26.9.1 |
| Number of flaws | Four (CVE-2026-121144 to CVE-2026-121147) |
| Reported by | Pranav Rajendran (credited by CERT-In) |
| Tata response | No reply to media e-mails at the time of reporting |
What are the four security flaws?
The four flaws are hardcoded keys inside the app package, weak URL checks in the app’s built-in browser view, login tokens written into debug logs, and broken SSL certificate pinning. Each opens a different route, from downloading the app and extracting secrets to intercepting the traffic between your phone and Tata’s servers.
Here is each one in plain language, based on the CERT-In descriptions reported by Business Standard and CNBC-TV18.
CVE-2026-121144, hardcoded credentials. The app package contained service account credentials, API keys and authorisation tokens. An attacker who is not logged in could download the app, pull these out and use them to reach backend services, exposing information or running unauthorised operations.
CVE-2026-121145, WebView validation. Many apps show web pages inside a built-in browser called a WebView. The iRA apps did not properly check which URLs and origins they loaded there. A remote attacker could feed in malicious web content, interact with app functions and grab live bearer tokens, the digital passes that prove you are logged in.
CVE-2026-121146, tokens in logs. Authentication tokens were written into logs meant for development and debugging. Someone with local access to those logs could reuse the session tokens to act as the owner.
CVE-2026-121147, SSL pinning. Certificate pinning is meant to make sure the app only talks to the genuine Tata server. CERT-In says it was implemented improperly, so an attacker positioned on the same network could intercept or modify the traffic.
What can the Tata iRA app control in your car?
The iRA apps turn a smartphone into a remote for the car. Owners can track its location, check vehicle health, trip details and fuel or battery status, and send remote commands such as locking the doors or setting cabin climate. That is why CERT-In treats impersonation as a serious risk.
If someone can pose as you inside the app, they inherit what the app can see and do. Location history and trip data are personal information in their own right. For EV owners on iRA.ev, the app is also part of daily charging routines, which we touched on in our Tata Sierra EV real-world range test. None of the reports say an attacker can drive the car, and readers should not assume that.
What should Tata car owners do now?
Update the app to iRA 2.0 version 26.8.2 or iRA.ev version 26.9.1, confirm the version number, and avoid sideloading app files from outside the official stores. It also helps to log out of old phones, keep your phone’s operating system updated and avoid using the app on public Wi-Fi.
A short checklist for owners:
- Open the Play Store or App Store and update iRA or iRA.ev.
- Check the version number inside the app.
- Sign out on any phone you no longer use, such as one you sold or handed down.
- Do not install iRA from an APK link shared on WhatsApp or Telegram.
- If you see a remote command or login you did not make, contact your Tata dealer or customer care and report it.
How many Tata owners could this affect?
Neither CERT-In nor Tata has said how many people use iRA 2.0 or iRA.ev, so there is no confirmed count of affected users. What is clear is that Tata sells connected models in large numbers every month, as our Tata September 2026 sales report shows, so the potential user base is large.
It is also unknown whether any of the flaws were exploited before the fix. Nothing in the reports suggests that, but no investigation result has been published either. We will update this article if Tata or CERT-In shares numbers.
Tata iRA app: confirmed vs not confirmed
| Item | Status |
|---|---|
| CERT-In note CIVN-2026-0537 rated “High” | Confirmed (Business Standard, ETAuto, CNBC-TV18) |
| Affected: iRA 2.0 ≤26.7.3, iRA.ev ≤26.7.2 | Confirmed |
| Fixed: iRA 2.0 26.8.2, iRA.ev 26.9.1 | Confirmed by CERT-In advice |
| Four CVEs covering keys, WebView, logs, SSL pinning | Confirmed |
| Researcher Pranav Rajendran credited | Confirmed (CNBC-TV18) |
| Any real-world attack on owners | Not reported |
| Number of affected users | Not disclosed |
| Official Tata Motors statement | Not issued at time of reporting |
| Any risk to driving controls | Not claimed by CERT-In |
CarBike Insight Analysis
Connected-car apps are now part of the purchase in India. Buyers compare screen sizes, remote AC and live tracking almost as much as mileage. This advisory is a reminder that each of those features is also a doorway, and that the security of the app matters as much as the badge on the bonnet.
The good news is that the system worked as it should. A researcher reported the bugs, CERT-In published a note with exact versions, and fixed builds exist. The weak spot is communication. Owners should not have to learn about a “High” severity flaw from a stock-market news feed. A push notification inside the app telling users to update would have done more than any press note.
There is a wider lesson too. Remote-access features are under scrutiny globally, as our Tesla FSD India and Korea unlock report showed in a different context. Indian carmakers are adding more over-the-air and app control features every year. Expect CERT-In notes like this one to become routine, and expect buyers to start asking dealers how often the app gets security fixes.
FAQ
What is the Tata iRA app warning about?
CERT-In has flagged four high-severity security flaws in Tata Motors’ iRA 2.0 and iRA.ev apps. They could let an attacker extract credentials, steal login tokens, impersonate an owner and reach vehicle-related information and services.
Which versions of the Tata iRA app should I update to?
Update iRA 2.0 to version 26.8.2 and iRA.ev to version 26.9.1. Affected builds are iRA 2.0 26.7.3 and below, and iRA.ev 26.7.2 and below.
Has any Tata car been hacked?
No attack on owners has been reported. CERT-In describes what an attacker could do with the flaws, not an incident, and the fixed app versions are already listed.
Do I need to visit a Tata service centre?
No. This is an app issue, not a vehicle recall. Updating iRA or iRA.ev from the official app store is the fix, and no workshop visit has been asked for.
Has Tata Motors responded to the CERT-In advisory?
Not yet, according to the reports. ETAuto and CNBC-TV18 said an e-mail to Tata Motors Passenger Vehicles had not been answered when their stories were published.
- Tata iRA App: CERT-In Flags Four High-Severity Flaws, Update Now
- Volkswagen Virtus Facelift: First Teaser Shows New Lights Before December
- Mahindra Q2 FY27 Results: Profit Up 25% as SUV Volumes Jump 26%
- Xpeng Mona L05: Deliveries Start With a 10,000-Unit Month Target
- Altigreen Minsara: Multi-Utility Electric Motorcycle From ₹1.24 Lakh