Tata Motors iRA App Warning has raised cybersecurity concerns among vehicle owners after the Indian Computer Emergency Response Team (CERT-In) identified four security vulnerabilities in older versions of the company’s connected vehicle applications.
The agency has classified the issues as HIGH severity and warned that attackers could potentially access sensitive credentials, impersonate users and obtain vehicle-related information.
The advisory, issued on November 4, 2026, covers Tata Motors iRA 2.0 and iRA.ev applications.
These apps are used by customers to access connected car features, including vehicle status, health monitoring, trip information and remote vehicle commands.
However, Tata Motors Passenger Vehicles has said that the identified vulnerabilities have been addressed through software updates and enhanced security measures.
The company also stated that its assessment found no evidence of customer data compromise.
 Tata Motors iRA App Warning: Which Versions Are Affected?
CERT-In has identified specific older versions of both applications as vulnerable.
The affected versions are:
Tata Motors iRA 2.0: Version 26.7.3 and earlier.
Tata Motors iRA.ev: Version 26.7.2 and earlier.
The iRA 2.0 application is designed for customers using Tata Motors vehicles with internal combustion engines (ICE), while iRA.ev serves electric vehicle owners.
Both applications provide connected vehicle services that allow customers to monitor important vehicle information and access selected remote functions through their smartphones.
The security advisory warns that successful exploitation could result in unauthorised access to sensitive information, user impersonation and unauthorised modification of application data.
Four Security Vulnerabilities Identified by CERT-In
CERT-In has identified four separate security weaknesses involving credential storage, application configuration, authentication tokens and network communication.
The first vulnerability involves hardcoded service account credentials, API keys and authorisation tokens embedded within the application packages.
An attacker could potentially extract these details and use them to access associated backend services without authentication.
The second issue concerns insufficient validation of URLs and website origins loaded through the applications’ WebView component.
Malicious web content could potentially expose live authentication tokens, allowing an attacker to impersonate a user and access connected vehicle services.
The third vulnerability relates to authentication tokens being recorded in application logs used for development and debugging.
A local attacker with access to these logs could retrieve the exposed session tokens and misuse them to access vehicle-related information.
The fourth issue involves improper implementation of SSL certificate pinning.
This weakness could allow an attacker positioned to intercept network traffic to monitor or modify communications between the mobile applications and their backend systems.
Together, these vulnerabilities create potential risks involving customer credentials, connected vehicle information and access to certain application services.
Tata Motors Responds to the Security Warning
Following the CERT-In advisory, Tata Motors Passenger Vehicles stated that the identified vulnerabilities had already been addressed through software updates and additional security measures.
The company said mandatory updates were rolled out in August and September 2026 for the two applications.
According to the company, the recommended versions are iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1.
The updates are automatically prompted when users open the respective applications and can be completed over the air within a few minutes.
Tata Motors also stated that the update rollout had been completed for all active users. The company is contacting customers who have not yet completed the updates to ensure they move to the latest versions.
Has Tata Motors Customer Data Been Compromised?
One of the major concerns following the advisory is whether attackers have already accessed customer information or vehicle-related data.
Tata Motors said its assessment found no evidence of unauthorised access to or compromise of customer credentials, personal information or vehicle-related data.
The company added that it continues to monitor its systems and strengthen security measures to protect connected vehicle services and customer information.
It is important to distinguish between a reported security vulnerability and a confirmed data breach.
CERT-In has identified weaknesses that could potentially be exploited, but its advisory does not establish that customer information has actually been stolen.
What Should Tata Motors Vehicle Owners Do?
Owners using the affected applications should check their installed app versions and ensure that the latest recommended updates have been completed.
Customers using iRA 2.0 should check for version 26.8.2, while iRA.ev users should ensure that version 26.9.1 is installed.
If an update notification appears when opening the application, users should follow the instructions to complete the installation.
It is also advisable to install applications and updates through official app stores, avoid suspicious links and never share account passwords or authentication codes with unknown individuals.
The Tata Motors iRA App Warning highlights the growing importance of cybersecurity in connected vehicles.
As cars increasingly depend on smartphone applications and internet-connected services, keeping associated software updated is an important step towards protecting personal information and vehicle functions.
