CVE-2026-121146

MediumCVSS 6.8/10Last modified Nov 5, 2026

Description

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session tokens.

Successful exploitation of this vulnerability could allow the attacker to impersonate the associated user and gain unauthorized access to vehicle related information and services.

Metrics

CVSS 4.0 6.8/10CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-532

Affected software

VendorProductVersions
Tata MotorsTata Motors iRA 2.0versions 26.7.3 and below
Tata MotorsTata Motors iRA.evversions 26.7.2 and below

References

Timeline

Published
Nov 4, 2026
Last modified
Nov 5, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1211478.5This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the netCVE-2026-1211489.6Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via CVE-2026-121156.6The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all vCVE-2026-1211569.6Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the CVE-2026-1211579.8Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions CVE-2026-1211586.5Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTCVE-2026-1211594.3Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypassCVE-2026-121169.8A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changeCVE-2026-1211607.4Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafteCVE-2026-1211616.5Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafCVE-2026-1211625.4UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engiCVE-2026-1211638.3Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer proc
CVE-2026-121146: Medium severity, CVSS 6.8 | Vulnix