CVE-2026-121144 · Other
NO FIX YET
The iRA 2.0 and iRA.ev mobile apps contain hardcoded service account credentials, API keys and authorization tokens inside the app package. An unauthenticated attacker can download the app, extract these secrets, and use them to reach backend services and possibly perform unauthorized operations.
first public Nov 4, 2026 · 2 sources
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone using the iRA 2.0 (ICE vehicles) or iRA.ev (EV) mobile apps is in scope, because the secrets sit in the app package that anyone can download. The risk falls mainly on the app's backend operator, since an attacker could use the extracted credentials against backend services. Sources do not say which services, which app versions, or whether the credentials were rotated.
Who cares ira-2.0, ira.ev, mobile-app
Check the installed version of the iRA 2.0 or iRA.ev app against the vendor's fixed release; no affected or fixed version has been published in any source I could read (unknown).
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedded sensitive information.
Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to associated backend services and potentially access sensitive information or perform unauthorized operations on the targeted system.
This page as .md · .json · in your agent: get_signal("CVE-2026-121144") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.