---
id: CVE-2026-121145
title: >-
  Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile
  application
summary: >-
  This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to
  insufficient validation of URLs and origins loaded within the WebView
  component. A remote attacker could exploit this vulnerability by sending
  malicious web c…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-346
  - CWE-749
vendor: Tata Motors
product: Tata Motors iRA 2.0
affected:
  - ira_2.0 versions 26.7.3 and below
  - ira.ev versions 26.7.2 and below
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T20:42:15.948016Z'
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:08:18.744Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121145'
references:
  - url: >-
      https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537
tags:
  - cve.org
epss: 0.00212
epssPercentile: 0.11568
ingestedAt: '2026-11-05T22:38:31.509Z'
---

## Overview

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView.

Successful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.

## Affected

- `ira_2.0 versions 26.7.3 and below`
- `ira.ev versions 26.7.2 and below`

## Remediation

Upgrade to latest versions:

Tata Motors iRA 2.0 to version 26.8.2 

Tata Motors iRA.ev to version 26.9.1