The RADIUS client and server use the shared secret to encrypt the password. If you know the shared secret, and you can capture RADIUS packets with encrypted passwords, you can decrypt them and get the user's unencrypted password.
Wireshark includes the ability to do this, of course:
perhaps dump the database?
No, the shared secret is used to protect things on the wire, not anything on disk or in the database. You'll note that the shared secret you found was specific to a client IP address; a RADIUS server can use a different shared secret for each system it's extending authentication services to... which implies, in turn, that it's not for the back-end password (else you'd need N copies of the back-end password for N shared secrets).
this radius server is used together with a krb5 server for authentication
Usually when a RADIUS server is used with KRB5, it's to extend authentication to dumber devices that don't support Kerberos. So you don't have to worry about Kerberos being tunneled over RADIUS; it's merely providing a down-level front-end to the back-end database that's part of Kerberos. It may do so by speaking RADIUS on one side and Kerberos on the other, but that doesn't change the fact that the RADIUS packets on the wire are vulnerable if you know the shared secret.