---
id: "CVE-2026-121144"
kind: "vulnerability"
aliases: ["CVE-2026-121144"]
title: "iRA mobile apps ship hardcoded service credentials, exposing backend services"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ira-2.0", "ira.ev", "mobile-app", "other"]
not_affected_if: []
published_at: "2026-11-04T13:17:26+00:00"
first_seen_at: "2026-11-04T13:27:01+00:00"
updated_at: "2026-11-04T13:29:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121144", "first_seen_at": "2026-11-04T13:27:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T13:29:09+00:00"}]
---

# iRA mobile apps ship hardcoded service credentials, exposing backend services

The iRA 2.0 and iRA.ev mobile apps contain hardcoded service account credentials, API keys and authorization tokens inside the app package. An unauthenticated attacker can download the app, extract these secrets, and use them to reach backend services and possibly perform unauthorized operations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed version of the iRA 2.0 or iRA.ev app against the vendor's fixed release; no affected or fixed version has been published in any source I could read (unknown).

## Timeline

- 2026-11-04T13:27:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121144
- 2026-11-04T13:29:09+00:00 analyst — Only the NVD/CERT-In description was available (linked, doc 67239); NVD page fetch returned empty and no CERT-In note or vendor advisory was found in search. iRA 2.0/iRA.ev appear to be Tata Motors apps per Tata's own PDF, but no source ties this CVE to Tata, so no product row. Affected versions, fix and rotation status unknown; nothing verified. Revisit when CERT-In publishes a CIVN note. Siblings CVE-2026-121145/121147 same apps.

## Documents

- [describes] NVD: CVE-2026-121144 (CNA: CERT-In) https://nvd.nist.gov/vuln/detail/CVE-2026-121144

## From the sources

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedded sensitive information.



Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to associated backend services and potentially access sensitive information or perform unauthorized operations on the targeted system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_