---
id: CVE-2026-121147
title: >-
  Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile
  application
summary: >-
  This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to
  improper implementation of SSL certificate pinning in the network security
  configuration, resulting in ineffective certificate pinning controls. An
  attacker p…
severity: high
cvss: 8.5
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-295
vendor: Tata Motors
product: Tata Motors iRA 2.0
affected:
  - ira_2.0 versions 26.7.3 and below
  - ira.ev versions 26.7.2 and below
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-04T20:41:44.554987Z'
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:07:49.340Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121147'
references:
  - url: >-
      https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537
tags:
  - cve.org
epss: 0.00088
epssPercentile: 0.00375
ingestedAt: '2026-11-05T22:38:31.510Z'
---

## Overview

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.

## Affected

- `ira_2.0 versions 26.7.3 and below`
- `ira.ev versions 26.7.2 and below`

## Remediation

Upgrade to latest versions:

Tata Motors iRA 2.0 to version 26.8.2 

Tata Motors iRA.ev to version 26.9.1