{"id":"CVE-2026-121144","kind":"vulnerability","aliases":["CVE-2026-121144"],"related":[],"title":"iRA mobile apps ship hardcoded service credentials, exposing backend services","description":"This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedded sensitive information.\n\n\n\nSuccessful exploitation of this vulnerability could allow the attacker to gain unauthorized access to associated backend services and potentially access sensitive information or perform unauthorized operations on the targeted system.","summary":"The iRA 2.0 and iRA.ev mobile apps contain hardcoded service account credentials, API keys and authorization tokens inside the app package. An unauthenticated attacker can download the app, extract these secrets, and use them to reach backend services and possibly perform unauthorized operations.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ira-2.0","ira.ev","mobile-app","other"],"not_affected_if":[],"how_to_check":"Check the installed version of the iRA 2.0 or iRA.ev app against the vendor's fixed release; no affected or fixed version has been published in any source I could read (unknown).","fix":null,"status":"open","published_at":"2026-11-04T13:17:26+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","triaged_at":"2026-11-04T13:27:54+00:00","updated_at":"2026-11-04T13:29:09+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-04T13:27:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"iRA mobile apps ship hardcoded service credentials, exposing backend services","impact":"high","summary":"The iRA 2.0 and iRA.ev mobile apps contain hardcoded service account credentials, API keys and authorization tokens inside the app package. An unauthenticated attacker can download the app, extract these secrets, and use them to reach backend services and possibly perform unauthorized operations.","audience":"everyone","category":"other","nicknames":[],"who_cares":["ira-2.0","ira.ev","mobile-app"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads embedded secrets and accesses backend services without authorization","analyst_note":"Check the NVD entry and vendor advisory for the affected app versions, whether credentials were rotated, and the fixed version.","how_to_check":"unknown","plain_action":"If you use the iRA 2.0 or iRA.ev app, check the app store for an update and install it once the vendor publishes one.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Anyone who installs the iRA 2.0 or iRA.ev mobile application, since the embedded secrets are in the distributed package. The sources do not say which backend systems are affected or whether the vendor has rotated the credentials. unknown","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4197,"output_tokens":506,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and vendor advisory for the affected app versions, whether credentials were rotated, and the fixed version.","search":"'-121144':13A,16A '-2.0':18B '-2026':12A,15A '2.0':25B,72C 'access':123C,130C 'account':33B,83C 'allow':117C 'api':35B,85C 'app':3A,22B,29B,42B,50B 'applic':76C,92C,104C 'associ':125C 'attack':46B,97C,119C 'author':38B,88C 'backend':9A,59B,126C 'contain':30B 'could':98C,116C 'credenti':7A,34B,84C 'cve':11A,14A 'download':48B,103C 'due':77C 'embed':108C 'exist':68C 'exploit':99C,112C 'expos':8A 'extract':51B,107C 'gain':121C 'hardcod':5A,31B,81C 'inform':110C,132C 'insid':40B 'ira':1A,17B,24B,71C 'ira.ev':19B,27B,74C 'key':36B,86C 'mobil':2A,21B,28B,75C 'mobile-app':20B 'oper':65B,136C 'packag':43B,93C,105C 'perform':63B,134C 'possibl':62B 'potenti':129C 'presenc':79C 'reach':58B 'remot':96C 'secret':53B 'sensit':109C,131C 'servic':6A,10A,32B,60B,82C,127C 'ship':4A 'success':111C 'system':140C 'target':139C 'token':39B,89C 'unauthent':45B,95C 'unauthor':64B,122C,135C 'use':55B 'vulner':67C,101C,115C 'within':90C","nicknames":[],"mitigations":[],"who_affected":"Anyone using the iRA 2.0 (ICE vehicles) or iRA.ev (EV) mobile apps is in scope, because the secrets sit in the app package that anyone can download. The risk falls mainly on the app's backend operator, since an attacker could use the extracted credentials against backend services. Sources do not say which services, which app versions, or whether the credentials were rotated.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the iRA 2.0 or iRA.ev app, check the app store for an update and install it once the vendor publishes one.","pkeys":[],"ptokens":[],"labels":["high","ira20","iraev","mobileapp","other"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vdisclose@cert-in.org.in","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121144","severity":null,"published_at":"2026-11-04T13:17:26+00:00","modified_at":"2026-11-04T13:17:26+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","fetched_at":"2026-11-04T13:27:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121144:1670","url":null,"severity":null,"published_at":"2026-11-04T13:29:09+00:00","modified_at":"2026-11-04T13:29:09+00:00","first_seen_at":"2026-11-04T13:29:09+00:00","fetched_at":"2026-11-04T13:29:09+00:00","note":"Only the NVD/CERT-In description was available (linked, doc 67239); NVD page fetch returned empty and no CERT-In note or vendor advisory was found in search. iRA 2.0/iRA.ev appear to be Tata Motors apps per Tata's own PDF, but no source ties this CVE to Tata, so no product row. Affected versions, fix and rotation status unknown; nothing verified. Revisit when CERT-In publishes a CIVN note. Siblings CVE-2026-121145/121147 same apps."}],"documents":[{"id":67239,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121144","title":"NVD: CVE-2026-121144 (CNA: CERT-In)","kind":"advisory","source":"analyst","publisher":null,"text":"This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this by downloading the application package and extracting embedded sensitive information. Successful exploitation could allow unauthorized access to associated backend services. CVSS 4.0 8.8 by vdisclose@cert-in.org.in. No version ranges or fix given.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}