Improper SSL Certificate Pinning in iRA Mobile Applications
CVE-2026-121147

8.5HIGH

Key Information:

Vendor

Tata Motors

Status
Tata Motors Ira 2.0
Tata Motors Ira.ev
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121147?

The iRA 2.0 and iRA.ev mobile applications are vulnerable due to improper implementation of SSL certificate pinning, leading to ineffective network security measures. This flaw allows an attacker to intercept or alter communications between the applications and backend services, putting sensitive data at risk. Proper SSL pinning should be enforced to ensure secure connections and protect users.

Affected Version(s)

Tata Motors iRA 2.0 versions 26.7.3 and below

Tata Motors iRA.ev versions 26.7.2 and below

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOT...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability is reported by Pranav Rajendran.
.