From one container foothold to the entire data tier

The challenge

A processor of regulated banking data for multiple tenant banks wanted to know the real blast radius available to an attacker who achieves code execution inside the production application container.

How it unfolded

1. Started from a simulated foothold inside one production app container.
2. Read decrypted secrets left in plaintext at container start.
3. Found the app's database account was a cluster superuser, reachable from the app.
4. Proved read/write across dozens of tenant databases, a central credit-risk dataset and the shared SSO store.
5. Recovered the production session-signing key — proven offline by reproducing a real signature — enabling forgery of any user, role or tenant.
6. Also recovered a GitOps deploy key and partner transfer keys (and their passphrases) from the same readable config.

Impact

A single container compromise escalated to cross-tenant data access, session forgery for any account, and a foothold back into the software supply chain.

Outcome

A fully-proven, step-by-step chain with a 24-hour P0 remediation plan: rotate the signing key, demote the database account, rotate deploy and partner keys. All capability was documented via metadata only — no customer rows were read.