CVE-2026-121144
Received Received - Intake

Hard-Coded Credentials in iRA Mobile Applications

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Indian Computer Emergency Response Team (CERT-In)

Description
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedded sensitive information. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to associated backend services and potentially access sensitive information or perform unauthorized operations on the targeted system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121144
EUVD
EUVD-2026-116892

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Tata Motors Tata Motors iRA 2.0 versions 26.7.3 and below
Tata Motors Tata Motors iRA.ev versions 26.7.2 and below

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to hardcoded service account credentials, API keys, and authorization tokens within the application package. An attacker can exploit this by downloading the app and extracting sensitive information, potentially gaining unauthorized access to backend services.

Detection Guidance

To detect this vulnerability, inspect the iRA 2.0 and iRA.ev mobile applications for hardcoded credentials, API keys, or authorization tokens. Analyze the application package files using tools like strings, apktool, or jadx to search for sensitive data in the code or configuration files.

Impact Analysis

An attacker could access sensitive information or perform unauthorized operations on the targeted system by exploiting this vulnerability. This may lead to data breaches, unauthorized account access, or misuse of services.

Compliance Impact

The vulnerability could lead to unauthorized access to sensitive information, which may violate compliance requirements under GDPR and HIPAA. Exposure of hardcoded credentials and tokens risks unauthorized data access or modification, potentially resulting in non-compliance with data protection and privacy regulations.

Mitigation Strategies

Immediately remove or replace all hardcoded credentials, API keys, and tokens in the iRA 2.0 and iRA.ev applications. Update the applications to use secure storage mechanisms for sensitive data and implement proper authentication and authorization controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...