Tata Motors iRA App CERT-In Warning Update India: Four High-Severity Flaws, Affected Versions and the Fix Explained

Illustrative image: a Tata Nexon EV — the iRA.ev app serves Tata's electric-vehicle owners. Image: Wikimedia Commons / DriveSpark, CC BY 3.0

TL;DR: The Tata Motors iRA app CERT-In warning update India owners need is here: CERT-In has flagged four high-severity flaws in the iRA 2.0 and iRA.ev connected-car apps that could expose credentials and vehicle data and let attackers impersonate users. iRA 2.0 versions 26.7.3 and below and iRA.ev versions 26.7.2 and below are affected — update to iRA 2.0 v26.8.2 or iRA.ev v26.9.1 now.

📌 Key Highlights

• CERT-In issued a "High" severity advisory on 4 November 2026 for Tata Motors' iRA 2.0 and iRA.ev connected-vehicle apps.
• Four flaws were found: hardcoded credentials in the app, a WebView validation weakness, authentication tokens written to logs, and broken SSL certificate pinning.
• Attackers could obtain sensitive credentials, access vehicle information and connected services, impersonate owners and modify app data without authorisation.
• Affected versions are iRA 2.0 v26.7.3 and below, and iRA.ev v26.7.2 and below; the fix is iRA 2.0 v26.8.2 and iRA.ev v26.9.1.
• No active exploitation has been reported — this is a patch-now warning, and updating the app closes all four flaws.

What happened in the Tata Motors iRA app CERT-In warning?

India's cyber emergency team, CERT-In, has flagged multiple high-severity security vulnerabilities in Tata Motors' iRA 2.0 and iRA.ev applications — the connected-car apps that let owners check vehicle status, monitor vehicle health, view trip information and send remote commands to their cars. The advisory, issued on Tuesday 4 November 2026, warns that the flaws "could allow an attacker to obtain sensitive credentials or access to vehicle related information and services."

The warning covers both sides of Tata's connected-car line-up: iRA 2.0 for the company's petrol and diesel cars, and iRA.ev for its electric vehicles. CERT-In has rated the overall severity as "High" and advises every affected user to update immediately. Tata Motors Passenger Vehicles did not respond to a request for comment from The Hindu BusinessLine.

The four flaws in the Tata iRA apps

CERT-In identified four separate vulnerabilities, each attacking a different part of how the apps store secrets, load web content and talk to Tata's backend servers. Together they could give an attacker the keys to a user's connected-car account.

Flaw	What it means	Risk to owners
Hardcoded credentials	Service account credentials, API keys and authorisation tokens are embedded inside the app package	Anyone who downloads the app can extract them and reach backend services
Insecure WebView configuration	URLs and origins loaded in the app's WebView component are not validated properly	Attackers can push malicious web content and steal authentication tokens
Tokens written to logs	Authentication tokens are recorded in application logs used for development and debugging	Exposed tokens can be misused to access user accounts
Broken SSL certificate pinning	Certificate pinning in the network security configuration is implemented improperly	Data between the app and Tata's servers could be intercepted or modified

Illustrative image: a Tata Nexon EV in Hyderabad. Image: Wikimedia Commons / Rajasekhar1961, CC BY-SA 4.0

Which versions are affected and how to update

The fix is simple and free: update the app from the Google Play Store or Apple App Store. CERT-In's advisory names the exact versions on both sides.

App	Affected versions	Safe version — update to
Tata Motors iRA 2.0 (petrol/diesel cars)	v26.7.3 and below	v26.8.2
Tata Motors iRA.ev (electric vehicles)	v26.7.2 and below	v26.9.1

To check your version, open the iRA app, go to its settings or profile section, and compare the version number. If it is at or below the affected version, update the app before your next drive — and turn on automatic app updates so the next security fix reaches you without a reminder. After updating, it is also worth changing your Tata connected-car account password as a precaution, since tokens from older versions may have been exposed in logs.

Why the Tata iRA warning matters for India readers

Tata Motors is India's largest electric-vehicle maker and one of its biggest car brands, so an app flaw here reaches lakhs of owners — from Nexon EV drivers using iRA.ev to Harrier, Safari and Punch owners on iRA 2.0. Connected-car apps are now the remote control for the car itself: location, lock status, charging, trip history and service records all flow through them, which is exactly why a credential flaw in one is more serious than a bug in an ordinary app.

The warning also lands in a busy week for CERT-In. The same advisory cycle included a separate "critical" severity warning for Android versions 14, 15, 16 and 17, and a 4 November advisory naming an AI-assisted threat campaign, CRAFTY FALCON, targeting Indian banks. Our recent coverage of the same pattern includes the DreamHost breach, where credentials sat exposed for months, and the Zyxel GS1900 zero-day, where a patch fixed the wrong bug. The lesson is the same every time: update first, investigate later.

Should you care?

✅ If you own a Tata car and use the iRA or iRA.ev app: yes — update the app today. It takes two minutes, it is free, and it closes all four flaws at once. Check the version number first so you know whether you are affected.

⏳ If you own a Tata car but never installed the iRA app: no action is needed. The flaws are in the apps, not in the car itself — but if you ever install the app, make sure it is the latest version.

FAQs

Which Tata Motors iRA app versions are affected by the CERT-In warning?
Tata Motors iRA 2.0 versions 26.7.3 and below, and Tata Motors iRA.ev versions 26.7.2 and below, are affected. CERT-In rated the vulnerabilities "High" severity in its advisory issued on 4 November 2026.

How do I update the Tata iRA app to the safe version?
Update from the Google Play Store or Apple App Store to iRA 2.0 version 26.8.2 or iRA.ev version 26.9.1. You can check your current version in the app's settings or profile section, and turning on automatic updates will install future security fixes without a reminder.

What can hackers do with the Tata iRA app flaws?
According to CERT-In, attackers could obtain sensitive credentials, access vehicle-related information and connected services, impersonate the owner and modify application data without authorisation. The four flaws involve hardcoded credentials, WebView validation, tokens in logs and broken SSL certificate pinning.

Is my Tata car itself affected, or only the app?
Only the apps are affected — the flaws are in the iRA 2.0 and iRA.ev software, not in the car's hardware. But because the apps control remote commands, vehicle status and trip data, updating them is the fix that matters.

Takeaway: Four high-severity flaws in Tata's connected-car apps could hand attackers your credentials and your car's data — but the fix is a free two-minute update to iRA 2.0 v26.8.2 or iRA.ev v26.9.1. If you drive a Tata, update the app before your next trip.

Follow India Tech on TechByCountry for tomorrow's 6 PM update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• The Hindu BusinessLine — CERT-In flags security vulnerabilities in Tata Motors' iRA connected vehicle apps
• Business Standard — Tata Motors' iRA apps vulnerable to data theft, user impersonation: CERT-In
• Times Now — Govt Finds 4 Security Flaws In Tata Motors Apps, Car Owners Asked To Update Now
• Digit — Using Tata Motors car? Govt warns hackers can steal your data from iRA apps
• CERT-In — Vulnerability Notes (cert-in.org.in)