GCVE-110-OSM-2026-1212

Connects directly to PostgreSQL using hardcoded credentials (user_strapi / 1QKtYPp18UsyU2ZwInVM), dumps the entire core_store table (Strapi JWT signing secrets + all plugin API key configs), strapi_administrator table (admin bcrypt hashes + emails), users-permissions_user (all CMS user accounts), and performs full enumeration and extraction of any table matching wallet/payment/transaction/deposit/withdraw/balance/address/key/secret/token keywords. Escalates to postgres superuser, enumerates all postinstall.js (174 lines): (1) new Client({ user: 'user_strapi', password: '1QKtYPp18UsyU2ZwInVM' }) — direct PG connection. (2) Dumps core_store (ALL rows, not just secrets), strapi_administrator, users-permissions_user, users-permissions_permission. (3) Regex wallet table filter: /wallet|payment|transaction|deposit|withdraw|balance|address|key|secret|token|fund|hot|cold/i — dumps matched tables in full (LIMIT 500). (4) Superuser escalation: user: 'postgres', password: '1QKtYPp18UsyU2ZwInVM'. (5) Enumerates all databases, connects to non-strapi DBs and lists their tables. (6) Docker socket: curl --unix-socket /var/run/docker.sock http://localhost/containers/json. (7) Reads deploy/*.groovy, config/*.js, helpers/*.js, extensions/, external APIs.