Tata Motors Passenger Vehicles has confirmed that security vulnerabilities identified in its iRA 2.0 and iRA.ev connected-car applications have been addressed through software updates and additional security measures. The clarification comes after India's cybersecurity agency, CERT-In, issued a high-severity warning about potential security risks affecting older versions of the applications.

According to Tata Motors, the necessary updates were rolled out in August and September 2026. The company has also stated that its internal assessment found no evidence of unauthorised access to or compromise of customer credentials, personal information or vehicle-related data.

The development is important for Tata car and EV owners who use connected-car applications to monitor vehicle health, check trip information and operate selected vehicle functions remotely.

CERT-In Flags High-Severity Security Vulnerabilities

The Indian Computer Emergency Response Team (CERT-In) issued a security advisory on November 4, 2026, identifying multiple vulnerabilities in specific versions of Tata Motors' iRA 2.0 and iRA.ev applications.

The agency classified the security issues as high severity, warning that successful exploitation could allow attackers to extract sensitive credentials, impersonate legitimate users and gain unauthorised access to vehicle-related information and connected services.

The advisory covered the following application versions:

• Tata iRA 2.0: Version 26.7.3 and earlier.

• Tata iRA.ev: Version 26.7.2 and earlier.

CERT-In recommended that users upgrade to the latest versions to address the identified security weaknesses.

Four Security Vulnerabilities Identified

CERT-In identified four security weaknesses involving the way the applications store credentials, validate web content, handle authentication tokens and communicate with backend systems.

The vulnerabilities could potentially create opportunities for unauthorised access if exploited.

The four issues include:

1. Hardcoded Credentials

The applications contained certain service-account credentials, API keys and authorisation tokens within their application packages. An attacker could potentially extract this information and attempt to access associated backend services.

2. Inadequate URL Validation

CERT-In identified weaknesses in the validation of URLs and origins loaded through the applications' WebView component. This could potentially expose authentication information when malicious web content is loaded.

3. Authentication Tokens in Application Logs

Certain authentication tokens were recorded in development and debugging logs. If an attacker gained access to these logs, the exposed tokens could potentially be misused to impersonate legitimate users.

4. Improper SSL Certificate Pinning

The agency also identified weaknesses in the implementation of SSL certificate pinning. This could potentially allow attackers positioned to intercept network traffic to monitor or modify communications between the applications and backend services.

These vulnerabilities collectively raised concerns about the security of customer credentials and connected-vehicle services.

Tata Motors Responds: Security Issues Already Fixed

Following the CERT-In advisory, Tata Motors Passenger Vehicles confirmed that the identified vulnerabilities had already been addressed through mandatory software updates and enhanced security measures.

According to the company's spokesperson, the updated versions were rolled out in August and September 2026.

Tata Motors explained that these updates are automatically prompted when customers open the respective applications. The updates can be completed over the air within a few minutes.

The company also stated that the rollout has been completed for all active users. It is proactively contacting customers who have not yet completed the updates to ensure they move to the latest versions.

Tata Motors Says No Customer Data Breach Found

One of the biggest concerns following the CERT-In warning was whether hackers had already accessed customer information or vehicle-related services.

Tata Motors has clarified that its internal assessment found no evidence of unauthorised access or compromise involving customer credentials, personal information or vehicle-related data.

The company has maintained that customer information remains secure and that it continues to monitor its systems for potential cybersecurity vulnerabilities.

This clarification is particularly relevant for owners who depend on connected-car technology for everyday vehicle monitoring and remote functions.

However, the company's statement should be understood as the outcome of its own assessment rather than a guarantee that no future security risks can arise.

What Is Tata Motors' iRA Application?

Tata Motors' iRA platform is a connected-car technology system designed to provide customers with digital access to selected vehicle functions through their smartphones.

The iRA 2.0 application caters to customers using compatible internal combustion engine (ICE) vehicles, while iRA.ev is designed for Tata electric vehicle customers.

Depending on vehicle compatibility and subscription availability, the applications offer features such as:

• Remote vehicle status monitoring.

• Vehicle health information.

• Trip history and driving information.

• Selected remote vehicle commands.

• Connected vehicle services.

• Access to vehicle-related information through a smartphone.

These features allow owners to monitor aspects of their vehicles without always needing to be physically present inside the car.

As connected-car technology becomes increasingly common, protecting these applications and their backend systems has become an important responsibility for automobile manufacturers.

What Should Tata Car and EV Owners Do?

Although Tata Motors says the security updates have been rolled out, customers should ensure that their applications are running the recommended versions.

Owners should follow these precautions:

1. Check whether the iRA 2.0 or iRA.ev application is updated.

2. Ensure iRA 2.0 is running version 26.8.2 or later.

3. Ensure iRA.ev is running version 26.9.1 or later.

4. Install any pending security updates when prompted.

5. Download application updates through official app stores.

6. Avoid sharing account passwords and authentication details with unknown individuals.

Customers who are unsure about their application version can contact Tata Motors customer support for assistance.

Growing Importance of Cybersecurity in Connected Cars

The Tata Motors iRA application issue highlights the growing importance of cybersecurity in the Indian automobile industry.

Modern vehicles increasingly depend on smartphone applications, cloud platforms, wireless communication and connected services. These technologies offer convenience but also introduce additional security considerations.

Automakers must regularly assess their software systems, strengthen authentication mechanisms and address vulnerabilities as they emerge.

The CERT-In advisory also highlights the role of India's cybersecurity agencies in identifying and communicating potential digital threats to businesses and consumers.

For vehicle manufacturers, maintaining the security of connected services is becoming just as important as improving conventional vehicle safety and reliability.

Conclusion

Tata Motors has confirmed that the security vulnerabilities identified in its iRA 2.0 and iRA.ev applications have been addressed through software updates and enhanced security measures.

The clarification follows CERT-In's high-severity warning concerning older versions of the connected-car applications. Tata Motors has also stated that its assessment found no evidence of customer data or vehicle-related information being compromised.

With the updated application versions already rolled out, Tata owners should ensure that they have installed the latest available updates. The incident highlights the growing importance of digital security as connected-car technology becomes an increasingly important part of modern vehicles.