CERT-In flags high-severity Tata iRA app flaws; updates issued

By Rahul Goyal · 6 Nov, 2026

CERT-In has flagged high-severity flaws in older Tata iRA 2.0 and iRA.ev app versions. Tata says fixes were rolled out; owners should check that the latest app is installed.

CERT-In flags high-severity Tata iRA app flaws; updates issued

India’s Computer Emergency Response Team (CERT-In) has flagged high-severity vulnerabilities in older versions of Tata Motors’ iRA 2.0 and iRA.ev connected-car applications. Tata Motors Passenger Vehicles says the fixes were rolled out through app updates, so owners who use remote commands, vehicle status or trip information should check the version installed on their phone.

Key takeaways

CERT-In’s 4 Nov 2026 vulnerability note rates the issue as High.
iRA 2.0 versions 26.7.3 and below, and iRA.ev versions 26.7.2 and below, are the affected ranges.
CERT-In lists iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 as the latest versions to install.
Tata says mandatory updates were rolled out in August 2026 for iRA 2.0 and September 2026 for iRA.ev.
Tata says it has found no evidence of unauthorised access to customer credentials, personal information or vehicle-related data.

Illustration: AI-generated, representative connected-car app security update. It does not show a specific Tata model or an official Tata Motors app screen.

What CERT-In flagged

CERT-In issued Vulnerability Note CIVN-2026-0537 on 4 Nov 2026. It identifies four vulnerabilities in the iRA 2.0 and iRA.ev mobile applications and rates their severity as High. The applications are used by Tata’s internal-combustion-engine and electric-vehicle customers to access connected services such as remote vehicle commands, vehicle status, health monitoring and trip information.

The advisory is about the application versions, not a vehicle-model recall. Its risk assessment says an attacker could potentially obtain sensitive credentials, impersonate a user, access vehicle-related information and services, or modify application data with the privileges of the impersonated user.

App	Affected versions	CERT-In listed update	Vehicle group
iRA 2.0	26.7.3 and below	26.8.2	Internal-combustion vehicles
iRA.ev	26.7.2 and below	26.9.1	Electric vehicles

In technical terms, the four issues involve hardcoded service credentials or tokens in the app package, weak validation of URLs loaded in the app’s WebView, authentication tokens being recorded in development logs, and ineffective SSL certificate-pinning controls. These details explain why the agency’s warning covers both account impersonation and possible access to connected services; they do not establish that any customer account was actually compromised.

What Tata Motors says about the fixes

In a statement reported by The Economic Times on 5 Nov 2026, Tata Motors Passenger Vehicles said the vulnerabilities had been addressed through software updates and enhanced security measures. The company said the iRA 2.0 update to version 26.8.2 was rolled out in August 2026, while the iRA.ev update to version 26.9.1 was rolled out in September 2026.

Tata said the updates are prompted automatically when users open the applications and can be completed over the air within a few minutes. It also said the rollout was completed for active users and that it was contacting customers who had not yet completed the update. Separately, the company said its assessment found no evidence of unauthorised access to or compromise of customer credentials, personal information or vehicle-related data.

That distinction matters. CERT-In has described a potential risk in older app builds; Tata’s statement describes the company’s current assessment and remediation. Neither source reports a confirmed customer-data breach.

What Tata owners can check now

Open the Google Play Store or Apple App Store on the phone paired with the vehicle and check whether the app is iRA 2.0 or iRA.ev.
Compare the installed version with the CERT-In cut-offs: iRA 2.0 versions 26.7.3 and below, and iRA.ev versions 26.7.2 and below, are affected. CERT-In lists the fixed builds as iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1.
Complete the update prompt through the official app store or the app’s normal update flow. Avoid downloading an APK or update link from an unknown message.
If the phone still shows an affected build after updating, record the app version and use Tata Motors’ official customer-support route rather than sharing account credentials with an intermediary.

The issue can matter during a trip because the affected apps provide access to status, health, location or trip information and remote commands. While checking the app, owners can independently estimate a journey with the FuelPrice fuel-cost calculator, check current rates on the live fuel prices page, or, for EV travel, find alternatives through the EV charging directory.

What changes for vehicle owners

There is no reported evidence in the cited advisory or company response that Tata vehicles’ driving systems were compromised. The immediate owner-level action is narrower: make sure the connected application is on the fixed build, keep the phone’s operating system and app-store security controls current, and treat any unexpected sign-in, remote-command or account notification as something to verify through official channels.

The episode also shows why connected features have become part of routine vehicle ownership. A car can remain mechanically usable while a companion app still needs a security patch. For that reason, the app version deserves the same quick check as insurance validity, FASTag status and other ownership records before a long journey.

What to watch next

CERT-In’s note lists Tata Motors as the vendor and names the two app stores for iRA 2.0 and iRA.ev. Tata says it is continuing to monitor its systems and reach customers who have not completed the update. Owners should rely on the app-store listing and direct company communication for any later version or support instruction, rather than treating forwarded screenshots as an official update.