Tata iRA CERT-In Warning: Were Tata Cars Hacked? What Is Confirmed and What To Do

By Meezan KhanNov 15, 20265 min read

ShortsWatch while you're here

All Shorts →

ShortToyota Innova Hycross Facelift 2026! 🚨 Abhi Kharidein Ya Wait Karein? #shorts

ShortKia Sonet 2027 Leaked! 🚨 Abhi Khareedein ya Wait Karein? #shorts

ShortRenault Duster 1.3L Turbo Cheaper by ₹1.5 Lakh! 😱 Big Strategy

ShortCybertruck is DEAD! 🚨 Elon Musk Kills Tesla's Biggest Mistake! 🤯 #Shorts

ShortThe 30% Ethanol Fuel Scam Exposed! 🚨 IOCL Petrol Test & CNG Biogas Truth 🤯 #shorts

ShortHilux is DEAD! 🚨 Mahindra's 3 NEW SUVs for 2027 Exposed! 🤯 #Shorts

ShortSafari is DEAD! 🚨 Mahindra Scorpio N 'Edition One' LEAKED! 🤯 #Shorts

ShortXUV700 is DEAD! 🚨 2027 Innova Hycross Facelift Launching Nov 25! 🤯 #Shorts

TorqueNM presenter holding a phone with a padlock icon beside a white Tata Curvv under the headline Tata iRA alert, not a car hack

The Tata iRA CERT-In warning is real, but it is not a story about Tata cars being hacked. India’s national cyber agency CERT-In issued a High-severity vulnerability note on 4 November 2026 about two Tata connected-car mobile apps, iRA 2.0 and iRA.ev, not about the cars’ own control systems. Tata Motors says the flaws were fixed through app updates in August and September 2026 and that it found no evidence of unauthorised access. This guide sets out what CERT-In actually said, what Tata has said back, which versions are affected and what owners should do.

Tata iRA CERT-In warning at a glance

Confirmed: CERT-In note CIVN-2026-0537, severity High, issued on 4 November 2026 for “Multiple Vulnerabilities in Tata Motors iRA and iRA.ev Application”.
Confirmed: the affected items are mobile apps: iRA 2.0 version 26.7.3 and below, and iRA.ev version 26.7.2 and below.
Confirmed: the fixed versions are iRA 2.0 26.8.2 and iRA.ev 26.9.1.
Company statement: Tata says it found no evidence of unauthorised access to credentials, personal information or vehicle data.
Not reported: any case of real-world exploitation, or any way to unlock or drive a car through these flaws.

What CERT-In actually said

The CERT-In vulnerability note lists four weaknesses in the apps, each with a CVE number. CVE-2026-121144 covers hardcoded service credentials, API keys and tokens inside the app package. CVE-2026-121145 is weak URL and origin validation in the app’s web view. CVE-2026-121146 is authentication tokens being written to app logs, which needs local access to the phone. CVE-2026-121147 is improper SSL certificate pinning, which could let an attacker on the network path intercept or alter traffic.

CERT-In describes the possible impact as extracting credentials, reaching backend services, obtaining live bearer tokens, impersonating an owner and altering data. That is a description of what the flaws could allow, not a report that any of it happened. The note credits a security researcher, Pranav Rajendran, with finding the issues. The page shows a later update date of 16 November, and the reason for that update is not stated.

What Tata Motors has said

Tata’s statement of 5 to 6 November, reported by Autocar India, says the issues were “addressed through software updates and enhanced security measures”. It says the updates were mandatory and pushed over the air: iRA 2.0 in August 2026 and iRA.ev in September 2026, prompted when the app is opened and taking a few minutes. Tata says the rollout is complete for all active users and that it is contacting anyone who has not updated.

The company also says there is “no evidence of any unauthorised access to or compromise of customer credentials, personal information or vehicle-related data”. Business Today carried the same statement. That is Tata’s own assessment, and we found no independent confirmation either way.

Which Tata cars are involved?

CERT-In names apps, not models. Autocar India says the connected-car technology is used on cars including the Curvv, Nexon, Harrier EV and Sierra EV, and that others use it as well. Tata has not published a complete list of covered models that we could find. The practical test is simple: if you use the iRA 2.0 or iRA.ev app, check its version number.

App	Affected versions	Fixed in
iRA 2.0	26.7.3 and below	26.8.2
iRA.ev	26.7.2 and below	26.9.1

What owners should do

Open the iRA app and accept any update it asks for.
Check that you are on iRA 2.0 26.8.2 or later, or iRA.ev 26.9.1 or later.
If you did not get an update prompt, update the app from the Play Store or App Store.
Use a screen lock on your phone, and avoid logging in on untrusted public Wi-Fi.
If you notice account activity you do not recognise, contact Tata through its official customer channels.

A note on our Short

Our Short’s title asked whether Tata cars were hacked. The honest answer is no: no hack has been reported. The warning is about weaknesses in two mobile apps that were fixed before CERT-In published its note, and Tata says it saw no evidence of compromise. “High severity” is CERT-In’s rating of the apps’ vulnerabilities, not a statement that cars can be taken over. We have framed it that way here, and we could not read the Short’s own description, so every claim on this page is sourced to CERT-In or the cited reports.

Should this change your buying decision?

Not by itself. Connected-car apps in every brand are updated regularly, and a patched app flaw is a reason to keep the app current, not to avoid a model. If you are weighing a Tata, compare the cars on price, features and safety, and see our guides to the Tata Nexon 2027 and the Tata Sierra-based Jeep SUV report.

We have not tested the iRA apps or any Tata car for this article. It uses CERT-In’s published note and Tata’s statements, and we will update it if either changes. More news is in our car news section.

Tata iRA CERT-In warning FAQs

Was a Tata car hacked?

No hack has been reported. CERT-In flagged weaknesses in the iRA mobile apps, and Tata says it found no evidence of unauthorised access.

Is my car affected?

Only the iRA 2.0 and iRA.ev apps are named, on versions 26.7.3 and 26.7.2 or older. Autocar India says models such as the Curvv, Nexon, Harrier EV and Sierra EV use the technology, but Tata’s full list is not stated.

What should I do?

Open the app and accept the update. Make sure you are on iRA 2.0 26.8.2 or later, or iRA.ev 26.9.1 or later.

Could someone unlock or drive my car through this?

No source we found says so. CERT-In describes possible credential and token exposure and impersonation of the owner in the app. It does not say the car can be unlocked or driven.

Has Tata responded?

Yes. Tata says the fixes shipped as over-the-air updates, iRA 2.0 in August and iRA.ev in September 2026, that the rollout is complete for active users, and that it is contacting those who have not updated.

We will update this page if CERT-In or Tata publishes anything further.