CVE-2026-121147 · Other
NO FIX YET
The iRA 2.0 and iRA.ev mobile apps do not correctly enforce SSL certificate pinning in their network security configuration. An attacker on the network path can intercept or modify traffic between the app and its backend services.
first public Nov 4, 2026 · 2 sources
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Users of the iRA 2.0 and iRA.ev mobile apps. An attacker on the same network, such as public Wi-Fi, could intercept or modify traffic between the app and its backend because certificate pinning is ineffective. No affected version range or fixed release has been published in the sources found. Teams and people who do not use these apps can skip it.
Not affected if app-not-installed
Who cares ira-mobile, mobile-apps
Unknown from the sources.
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.
This page as .md · .json · in your agent: get_signal("CVE-2026-121147") · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.