A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token. This issue affects Rancher: before 2.15.1.

A security flaw was identified in Rancher Manager where the ext.cattle.io/v1 Token store improperly drops its internal owner filter when a non-administrative user supplies a label selector referencing a different user. This logic error allows any authenticated user to list and watch all other users' tokens without restriction. The vulnerability exposes token metadata and stored salted hashes of bearer tokens, which could be leveraged for further attacks. The flaw affects all Rancher versions prior to 2.15.1 and is classified as a high-severity information disclosure issue. A fix has been released in Rancher v2.15.1. Organizations running Rancher should update immediately to mitigate the risk of unauthorized token access and potential privilege escalation.