Rancher 'Audit Log' leaks sensitive information

Rancher's audit logging feature can unintentionally record sensitive information like passwords and tokens in its logs. This happens only if audit logging is enabled and set to capture detailed activity, putting systems at risk if logs are accessed by unauthorized users.

Rancher audit logs (when AUDIT_LEVEL ≥ 1) fail to sanitize sensitive data such as credentials and authentication tokens, resulting in information disclosure (CWE-532). The vulnerability affects deployments with audit logging explicitly enabled; an attacker with access to audit log files can retrieve exposed credentials used in API requests.