---
id: CVE-2026-121146
title: >-
  Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile
  application
summary: >-
  This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to
  the recording of authentication tokens in application logs used for
  development and debugging. A local attacker with an access to logs could
  exploit this vuln…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-532
vendor: Tata Motors
product: Tata Motors iRA 2.0
affected:
  - ira_2.0 versions 26.7.3 and below
  - ira.ev versions 26.7.2 and below
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T20:42:04.605848Z'
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:08:03.789Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121146'
references:
  - url: >-
      https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537
tags:
  - cve.org
epss: 0.00119
epssPercentile: 0.01795
ingestedAt: '2026-11-05T22:38:31.509Z'
---

## Overview

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session tokens.



Successful exploitation of this vulnerability could allow the attacker to impersonate the associated user and gain unauthorized access to vehicle related information and services.

## Affected

- `ira_2.0 versions 26.7.3 and below`
- `ira.ev versions 26.7.2 and below`

## Remediation

Upgrade to latest versions:

Tata Motors iRA 2.0 to version 26.8.2 

Tata Motors iRA.ev to version 26.9.1