---
title: "CERT-In Flags Tata Motors iRA App Flaws | bharat.digital"
description: "Business Standard and YourStory report four flaws in older iRA 2.0 and iRA.ev builds; Tata says updates shipped and it found no customer data compromise."
url: "https://bharat.digital/originals/tata-motors-ira-cert-in-high-severity-connected-vehicle-apps/index.md"
canonical: "https://bharat.digital/originals/tata-motors-ira-cert-in-high-severity-connected-vehicle-apps/"
published: "2026-11-06T02:50:00+04:00"
updated: "2026-11-06T02:50:00+04:00"
section: "Originals"
type: "startup"
author: "bharat.digital desk"
image: "https://bharat.digital/img/originals/tata-motors-ira-cert-in-high-severity-connected-vehicle-apps-auto-ee4fd2c9-og.jpg"
language: "en-IN"
site: "bharat.digital"
---

# CERT-In rates Tata Motors iRA connected car apps High severity over credential and impersonation risks

*Business Standard and YourStory report four flaws in older iRA 2.0 and iRA.ev builds; Tata says updates shipped and it found no customer data compromise.*

By bharat.digital desk. Startup, Startups & Fintech. Published 2026-11-06T02:50:00+04:00. 1 min read.

![CERT-In rates Tata Motors iRA connected car apps High severity over credential and impersonation risks](https://bharat.digital/img/originals/tata-motors-ira-cert-in-high-severity-connected-vehicle-apps-auto-ee4fd2c9-hero.webp)

## At a glance

- Company: Tata Motors Passenger Vehicles (iRA apps)
- What it does: Connected vehicle mobile apps for Tata Motors ICE and EV customers, covering remote commands and vehicle status
- Latest: CERT-In High severity advisory on iRA 2.0 and iRA.ev; company says fixed builds shipped
- Date: 2026-11-05

India's Computer Emergency Response Team (CERT-In) has flagged multiple high severity vulnerabilities in older versions of Tata Motors' iRA 2.0 and iRA.ev connected vehicle apps. Business Standard, citing the advisory, said the affected builds are iRA 2.0 version 26.7.3 and earlier and iRA.ev version 26.7.2 and earlier. YourStory carried the same version numbers and severity. The apps let ICE and EV owners use remote commands, vehicle status, health monitoring and trip information.

CERT-In described four issues: hardcoded service account credentials, API keys and authorisation tokens inside the app package; weak validation of URLs and origins loaded in WebView; authentication tokens written into development and debug logs; and improper SSL certificate pinning. Business Standard summarised the risks as credential theft, user impersonation and unauthorised changes to application data, including access to vehicle related services if an attacker obtains live tokens.

CERT-In advised users to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1. A Tata Motors Passenger Vehicles spokesperson told Business Standard the company found no evidence of unauthorised access to customer credentials, personal information or vehicle related data, and that mandatory updates rolled out in August and September 2026 with over the air prompts. YourStory quoted a matching company line that active users had been updated and remaining customers were being chased to finish the upgrade.

The advisory lands while CERT-In is also warning banks and fintechs about AI assisted API abuse. Connected car apps sit at the same junction of consumer identity, remote control and cloud backends, so version lag becomes a security problem the moment an old build stays on a phone. Owners who still see older version numbers should update before treating remote lock or status features as routine.

## Sources

1. [Business Standard: Tata Motors' iRA apps vulnerable to data theft, user impersonation: CERT-In](https://www.business-standard.com/companies/news/tata-motors-ira-apps-vulnerable-to-data-theft-user-impersonation-cert-in-126110500606_1.html)
2. [YourStory: CERT-In warns of security vulnerabilities in Tata Motors' connected vehicle apps](https://yourstory.com/2026/11/cert-in-security-vulnerabilities-tata-motors-connected-vehicle-apps)
3. [ET Auto: CERT-In flags security vulnerabilities in specific versions of Tata Motors connected vehicle apps](https://auto.economictimes.indiatimes.com/news/auto-technology/cert-in-flags-security-vulnerabilities-in-specific-versions-of-tata-motors-connected-vehicle-apps/135548056)

Written by the bharat.digital desk from the sources above. Figures are as reported by those sources.