Tata Motors iRA app flaws: CERT-In flags data theft risk, urges update

The Indian Computer Emergency Response Team (CERT-In), the national agency for cyber security, has rated multiple vulnerabilities in Tata Motors' iRA 2.0 and iRA.ev connected-vehicle mobile apps as high severity, warning that they could allow data theft and user impersonation. The advisory, CIVN-2026-0537, was issued on Wednesday, 4 November 2026. It covers iRA 2.0 version 26.7.3 and below and iRA.ev version 26.7.2 and below, and asks users to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1. Tata Motors said these fixed versions were already rolled out as mandatory updates in August and September 2026.

Connected-vehicle apps link a car owner's phone to the car and to the maker's servers. Through such apps, owners can typically check the car's location and status and use remote features. That makes the security of these apps important: a weakness can expose not just personal details but information about a vehicle and its owner's movements.

The three flaws CERT-In listed are of a familiar kind. "Hardcoded credentials" means secret keys and passwords were built into the app itself, where a skilled attacker who unpacks the app could find and misuse them to talk to the company's servers. A WebView is a small browser inside an app; if it does not properly check which web pages it loads, an attacker may be able to make it open a harmful page. And writing login "tokens", the digital passes that keep a user signed in, into debugging logs can let someone with access to those logs pretend to be that user.

CERT-In's advisory said these weaknesses could allow data theft and user impersonation. Severity scores for the individual flaws listed by trackers range from about 7.1 to 8.8 on a 10-point scale, though the figures differ by source and the US National Vulnerability Database's analysis was still pending. No report of the flaws being used in a real attack had been recorded, according to one vulnerability tracker.

The case also shows a gap between fixing and disclosing. Tata Motors says the corrected app versions were pushed in August and September 2026, while the public advisory came on 4 November. Users who have not opened their apps since then, or who block updates, may still be running older versions.

Peepals timeline: Tata Motors pushed iRA 2.0 version 26.8.2 as a mandatory update in August 2026 and iRA.ev version 26.9.1 in September 2026, according to the company. CERT-In issued advisory CIVN-2026-0537 on Wednesday, 4 November 2026, rating the flaws in older versions high severity. Reports on the advisory followed on 5 November 2026. The gap between the iRA 2.0 fix and the public advisory was about three months.

Short-term: Owners of Tata Motors vehicles who use the iRA 2.0 or iRA.ev apps should check that they are on the fixed versions; opening the app should trigger the mandatory update, according to the company.

Long-term: The advisory adds to pressure on Indian carmakers to test connected-car apps for security before release, as more vehicles are sold with app-based features.

Who is affected: Tata Motors car and electric vehicle owners who use the iRA apps; Tata Motors' connected-vehicle and IT teams; and the wider automotive industry building similar apps.

Questions and Answers