TATA MOTORS IRA 2.0 · CVE-2026-121145 · Other
NO FIX YET
The Tata Motors iRA 2.0 (26.7.3 and below) and iRA.ev (26.7.2 and below) apps do not properly validate URLs and origins in their WebView. Malicious web content sent to it could expose live bearer tokens and let an attacker impersonate the user on vehicle services.
first public Nov 4, 2026 · 2 sources
Running Tata Motors iRA 2.0? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Owners using the Tata Motors iRA 2.0 (up to 26.7.3) or iRA.ev (up to 26.7.2) mobile apps. The apps do not properly validate URLs and origins loaded in their WebView, so malicious web content sent to it could expose a live bearer token and let an attacker act as the user on vehicle services. Users on newer versions are listed as unaffected by the CVE record; no exploitation is reported.
Not affected if unknown
Who cares android, ios, ira-app, ira-ev, mobile, tata-motors, vehicle-services, webview
26.7.3 or lower, iRA.ev version 26.7.2 or lowerNo fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView.
Successful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.
This page as .md · .json · in your agent: get_signal("CVE-2026-121145") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.