Using Tata Motors car? Govt warns hackers can steal your data from iRA apps, here is how to stay safe

Tata cars are a popular choice among Indians for their safety and value quotient. While the vehicle maker introduces new safety features and updates for its cars regularly, a recent update concerning the iRA application should be a top priority if you use a Tata car. The Indian cyber watchdog CERT-In has issued a "high" severity rating warning for multiple vulnerabilities in Tata Motors’ iRA apps. According to the note shared by the government agency, the affected systems include Tata Motors iRA 2.0 versions 26.7.3 and below and iRA.ev versions 26.7.2 and lower.

Hackers may access sensitive information of Tata cars

According to the cyber agency under the Ministry of Electronics and Information Technology, the reported vulnerabilities could let hackers access sensitive credentials and vehicle-related information and services. The other associated risks include user impersonation and unauthorised editing of app data. For the unaware, the iRA mobile app is Tata Motors' connected experience for its ICE (Internal Combustion Engine) and EV customers. The app supports vehicle commands remotely and displays vehicle status and trip details. CERT-In highlighted four vulnerabilities in these apps.

Also Read: Millions of bank users at risk? I4C and CERT-In warns of AI powered cyberattacks, check details

The "Hardcoded Credentials" vulnerability could be exploited to download the app package and extract the sensitive embedded information. Expanded access could enable hackers to sneak into backend services and perform unauthorised operations. Secondly, the "Insecure Configuration" flaw could let remote attackers send malicious web content to the affected WebView component.

CERT-In has published Vulnerability Notes on its website. Multiple Vulnerabilities in Tata Motors iRA and iRA.ev Application https://t.co/QTIsWhMjV8 Multiple Vulnerabilities in Android OS https://t.co/lAlTeMlVU7

— CERT-In (@IndianCERT) November 4, 2026

The stated vulnerability could allow bad actors to "perform unauthorised interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle-related information and services." Similarly, the "Information Disclosure" vulnerability could allow a local attacker to retrieve and misuse exposed session tokens. Lastly, the "Security Misconfiguration" backdoor could allow attackers to intercept or modify communications between the app and its backend services.

Update iRA apps now

CERT-In and Tata Motors recommend that car owners upgrade to iRA 2.0 and iRA.ev apps to versions 26.8.2 and 26.9.1, respectively.

Also Read: Govt launches Network Anubhav: What it is and how it helps check internet speed, track complaints and report spam

Warning issued for Android 17, 16 and below users

Meanwhile, CERT-In also issued a “critical” severity rating warning for Android OS users. As per the vulnerability note, the affected Android versions include Android 14, 15, 16 and 17. The reported vulnerabilities “could allow an attacker to gain elevated privileges, disclose sensitive information, execute arbitrary code or cause denial-of-service conditions on affected devices,” the note read. Individuals and organisations using devices running the above-mentioned open-source operating system versions were at a high risk of privilege escalation, information leaks and denial-of-service attacks. Users using devices running Android 17 or below were urged to apply the latest update.