Authentication Token Exposure in iRA Mobile Apps by iRA
CVE-2026-121146

6.8MEDIUM

Key Information:

Vendor

Tata Motors

Status
Tata Motors Ira 2.0
Tata Motors Ira.ev
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121146?

In iRA 2.0 and iRA.ev mobile applications, sensitive authentication tokens are improperly recorded in application logs intended for development and debugging purposes. This flaw creates a potential risk for local attackers with access to these logs, allowing them to retrieve and misuse the exposed session tokens. If successfully exploited, attackers could impersonate the impacted user, facilitating unauthorized access to sensitive vehicle-related data and services.

Affected Version(s)

Tata Motors iRA 2.0 versions 26.7.3 and below

Tata Motors iRA.ev versions 26.7.2 and below

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOT...
third-party-advisory

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability is reported by Pranav Rajendran.
.