Embedded service credentials
An unauthenticated remote attacker can extract hardcoded service-account credentials, API keys and authorization tokens from the application package and potentially access associated backend services.
Tata Motors iRA apps expose embedded credentials and vehicle-service authentication tokens
CERT-In discloses four flaws in iRA 2.0 through 26.7.3 and iRA.ev through 26.7.2: embedded credentials, WebView token exposure, logged tokens and ineffective certificate pinning. Update to 26.8.2 and 26.9.1 respectively. Each attack has different prerequisites; no confirmed exploitation or vehicle-control incident is reported.
- Disclosed
- Nov 4, 2026
- Public disclosure date
- Severity
- Sharted
- 4 CVEs tracked here
- Splash zone
- iRA 2.0 ≤26.7.3 / iRA.ev ≤26.7.2; package extraction, malicious WebView content, local log access or traffic interception
- Tata Motors · iRA · mobile security
- In the wild
- Unknown
- CERT-In describes vulnerabilities, not confirmed exploitation or victim totals.
What happened
The affected apps provide connected services for Tata Motors combustion-engine and electric vehicles, including vehicle information, trip records and remote commands. CERT-In warns about access and data modification with the impersonated user’s privileges; it does not demonstrate arbitrary control of every vehicle or a backend-wide compromise.
The four flaws are separate paths, not a proven exploit chain. Extracting service credentials requires obtaining the application package, while the WebView issue requires malicious content to reach that component. Logged-token theft requires local access to the logs; certificate-pinning exploitation requires an interception position. These conditions should not be collapsed into a claim that every nearby or internet attacker can take over a car.
The official remedy is iRA 2.0 26.8.2 and iRA.ev 26.9.1. No affected-person count, campaign-specific IoCs, exploitation confirmation or assurance about previously exposed tokens is supplied. The rating reflects authentication exposure in broadly used connected-vehicle applications, including credentials extractable without an account.
What’s in the bowl
WebView origin validation
Malicious content delivered to the affected WebView can expose live bearer tokens and permit user impersonation. The CNA vector includes passive user interaction.
Authentication tokens in logs
A local attacker who can access development/debugging logs can retrieve session tokens and impersonate the associated user.
Ineffective certificate pinning
An attacker able to intercept network traffic may read or modify application/backend communications because pinning controls are ineffective.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Tata Motors iRA 2.0 | 26.8.2 | |
| Tata Motors iRA.ev | 26.9.1 |
Crime-scene timeline
Nov 4, 2026
CERT-In publishes CIVN-2026-0537
The high-severity advisory lists four CVEs, affected versions and separate app upgrade targets, crediting Pranav Rajendran.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- CERT-In CIVN-2026-0537 original advisoryPrimaryNovember 4 public advisory defines all four flaws, distinct prerequisites, affected versions, fixed app versions and official store links. It does not establish successful real-world attacks or a vehicle-control incident.
- CERT-In CNA record for the WebView flawPrimaryConfirms malicious WebView content can expose live bearer tokens and potentially enable impersonation; the CVSS 4 vector includes passive user interaction. Repeats both upgrade targets.