---
id: "CVE-2026-121147"
kind: "vulnerability"
aliases: ["CVE-2026-121147"]
title: "iRA mobile apps: broken certificate pinning lets traffic be intercepted"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ira-mobile", "mobile-apps", "other"]
not_affected_if: ["app-not-installed"]
published_at: "2026-11-04T13:17:27+00:00"
first_seen_at: "2026-11-04T13:27:01+00:00"
updated_at: "2026-11-04T13:28:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121147", "first_seen_at": "2026-11-04T13:27:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T13:28:57+00:00"}]
---

# iRA mobile apps: broken certificate pinning lets traffic be intercepted

The iRA 2.0 and iRA.ev mobile apps do not correctly enforce SSL certificate pinning in their network security configuration. An attacker on the network path can intercept or modify traffic between the app and its backend services.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether iRA 2.0 or iRA.ev is installed on the device. The sources give no affected or fixed version numbers, so compare against the app store changelog once the vendor publishes one. Avoid using the app on untrusted Wi-Fi until an update is out.

## Timeline

- 2026-11-04T13:27:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121147
- 2026-11-04T13:28:57+00:00 analyst — No vendor advisory or CERT-In note found via search; NVD page fetched empty. Affected versions and fix unknown. Settle by finding the CERT-In CIVN note (reporter vdisclose@cert-in.org.in) or the app store changelog. Nothing verified. Tata Motors publishes iRA 2.0/iRA.ev per its own PDF, but the CVE text does not name a vendor.

## From the sources

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_