Keeper Release Notes

Breaking changes:

KeeperFile.url: Changed from String to String?. Callers treating url as non-null must now handle the nullable case; the server can omit this field and the previous behavior was an NPE crash.

KeeperRecordData.custom: Changed from MutableList? to non-null MutableList. Assigning null to this field no longer compiles. Use an empty list instead.

KEY_SERVER_PUBIC_KEY_ID deprecated: The misspelling published in 17.2.0 is replaced by KEY_SERVER_PUBLIC_KEY_ID. The old name is retained as a @Deprecated alias for source and bytecode compatibility; the stored config key ("serverPublicKeyId") is unchanged.

• KSM-878 / KSM-1032: Added automatic throttle retry with exponential backoff. HTTP 403 throttle responses are retried up to 5 times (11s–176s, ±25% jitter); retry_after is honored. Raises KeeperThrottleException once retries are exhausted.
• KSM-1008: Added typed KeeperRecordLink accessors (Python parity): permission booleans (allowsRotation, allowsConnections, etc. with allowedSettings fallback), credential flags, and accessors for AI/JIT settings and metadata.
• KSM-902: Added custom server public key support via the serverPublicKey config field, a 4-segment one-time token, or SecretsManagerOptions. While a custom key is active, server rotation hints raise a clear error instead of silently overwriting it.
• KSM-1026: SecretsManagerException is now a public open class; callers can catch SDK errors by type instead of catching bare Exception. KeeperThrottleException extends it and is also public.
• KSM-1072: Added dbConnectionMethod field to PamSettingsConnection, matching the field available in other SDKs.
• KSM-823: Fixed KeeperRecordData.custom being omitted from record create payloads when no custom fields were set; the field now defaults to an empty list.
• KSM-854: Fixed a crash when downloading file metadata from records created by iOS, Android, or Web Vault clients; these clients omit lastModified, which was previously required by the deserializer.
• KSM-753: Fixed shared folder records returning null fields; records encrypted with a folder key (created via Commander or PowerShell) were previously decrypted with the app key.
• KSM-765: Fixed an NPE crash when a file's url field is absent; downloadFile() now throws a typed exception instead.
• KSM-855: Fixed file descriptor leaks in LocalConfigStorage and connection leaks in downloadFile, uploadFile, and postFunction.
• KSM-985: Fixed base64ToBytes("") and webSafe64ToBytes("") throwing an opaque NPE on empty input; both now raise SecretsManagerException naming the affected field.
• KSM-1066 / KSM-1067: Fixed IL5 serverPublicKey not being persisted to LocalConfigStorage after initialization. Also fixed rotation hints from the server silently overwriting a configured custom key.

Links:

• Maven Central package
• See Java SDK Documentation

Original source

Bug Fixes

VAUL-9113: Fixed trash sync/restore for non-root records in Nested Shared Folders, enabling decryption and recovery at any folder level

VAUL-9099: Resolved GitHub Dependabot security alerts

VAUL-9125: Fixed an issue where users were unable to create records within the Nested Shared Folders system

Web Vault Update Instructions

To ensure you're using the latest Web Vault, simply reload the vault login page (or Shift+Ctrl/Cmd+R to force refresh)

Desktop Update Instructions

If you installed Keeper Desktop directly from the Keeper website, download the latest version from:
https://www.keepersecurity.com/download.html?t=d

If you installed Keeper Desktop from the Mac App Store or Microsoft Store, visit the store to perform the update.

Original source

New Features

• Vault-style passphrase generation
• New pam action service map command to map users to discovered Windows services.
• KeeperAI setting pam connection ai now supports --enabled / -e and --session-terminate / -st flags to configure resource-level AI settings.

Improvements

• PAM graph migration — Service discovery data migrated from the user service graph to the PAM graph.

Bug Fixes

• Fixed KEEPER_SSL_CERT_FILE being ignored for SSL verification in REST, PAM, tunnel HTTP, and DAG connections.
• Fixed nsf-mkdir to correctly resolve existing parent folder UIDs in paths instead of treating them as literal names.
• Fixed non-owners being able to attach PAM rotation scripts; uploads are now flagged with is_script for server-side owner enforcement.
• Fixed OS type detection by lowercasing the value before comparing against "windows".
• Fixed mc_transfer_perform to respect the treeKeyTypeId property.

Original source

This is a security update for the Keeper Bridge which hardens the local service. We recommend all customers upgrade to the latest version.

Security Updates

• EB-488: Fixed unauthenticated WCF service vulnerability. Inter-process communication now uses Named Pipes, restricting access to localhost only.
• EB-483: Hardened file system permissions on the Bridge data directory to prevent unauthorized access to sensitive database files by non-admin users.

Updating

After successful installation/upgrade of the Keeper Bridge, the server must be rebooted once before running Register.

Resources

Keeper Bridge guide

Original source

KeeperDB is a fast, secure, cross-platform database management tool. Use it inside KeeperPAM connections or as a standalone desktop app on Windows, macOS, and Linux.

Query, explore, and operate PostgreSQL, MySQL, SQLite, Microsoft SQL Server, Oracle, and Amazon Redshift from one interface.

KeeperDB is built for engineers and data scientists. It replaces legacy tools like DBeaver, MySQL Workbench, and pgAdmin. In KeeperPAM, it brings core database workflows into a fully managed passwordless experience.

Quick Links

Product Documentation | Download Now

What's New in 2.2.0

KeeperDB 2.2.0 makes Oracle databases easier to connect to, resolves file exports issues when working through Keeper Gateway, and fixes a range of bugs and improvements across SQL Server, MySQL, and the desktop app.

Oracle connections work out of the box on desktop

The desktop apps (macOS, Windows, Linux) now ship with Oracle Instant Client bundled. Oracle connections no longer require a separate Instant Client installation — open KeeperDB and connect directly. If you have an existing Oracle client installed, KeeperDB will still use it; the bundled client is a fallback.

Support for Keeper Vault's new Shared Folder system

KeeperDB storage backed by Keeper Vault now supports the updated Nested Shared Folder architecture.

macOS Universal binary (Intel + Apple Silicon)

The macOS DMG now contains a single universal binary that runs natively on both Intel and Apple Silicon Macs.

Gateway / RBI Improvements

File exports and downloads now work reliably through the Keeper Gateway PAM connections.

SQL Server

KeeperDB now supports Azure Managed Instances.

SQL Server connections via Amazon RDS now negotiate TLS correctly. The "database" field is now optional on the connect form.

On desktop, SQL Server credentials imported from Keeper Vault were not being matched against the Saved Connections sidebar. This is fixed.

MySQL / MariaDB

Hash (#) comments are now supported. MySQL and MariaDB permit # as a single-line comment.

TINYINT columns display as integers, not booleans

TINYINT and BOOLEAN columns previously rendered as tr1/0, which matches the actual wire value and avoids confusion when the column is used as a small integer rather than a flag.

Editor and Query

Running selected areas of the editor skips commented-out SQL

When running a selection that contains lines toggled off with -- comments, those lines are now excluded from execution.

Multi-statement result blocks are correctly sized. Result blocks for queries with multiple statements are now sized to fit their content instead of overflowing or collapsing.

Query timeout extended to 3600 seconds. The maximum configurable query timeout is now 1 hour for long-running analytical queries.

Resources

KeeperDB Documentation

KeeperDB Proxy Documentation

KeeperDB Feature Page

KeeperAI Documentation

KeeperPAM

Roadmap

We publish bi-weekly updates based on customer feedback. Send feature requests and bug reports to [email protected], or post on our Reddit community page.

Original source

Keeper Privileged Cloud — Just-In-Time Access for the Modern Enterprise

Keeper Privileged Cloud delivers identity-based, just-in-time (JIT) access across cloud platforms and directory services. By granting temporary elevated access only when needed — and revoking it automatically when the session ends — Keeper Privileged Cloud eliminates standing privilege risk while keeping your workforce productive and your security posture strong.

Access is enforced directly at the identity layer by temporarily modifying role assignments, group memberships, or entitlements within your existing identity provider — whether that's through SSO, federated applications, or role-based access controls. No manual cleanup, no forgotten permissions, and a full audit trail every step of the way.

Key Benefits

• Eliminates standing access risk with automatic, time-bound privilege grants
• Identity-native enforcement through your existing SSO, group, and RBAC policies
• Full auditability with complete logs of every access grant and revocation events

When to Use Privileged Cloud

Privileged Cloud is the right fit when:

• Access is granted through an identity provider, directory group, or cloud role
• Users sign in through SSO or a federated login flow
• You want temporary entitlements instead of shared privileged accounts
• Access must be approved, time-bound, and fully auditable

Prerequisites

Privileged Cloud extends KeeperPAM's Just-In-Time Access (JIT) framework. Before configuring, confirm the following are in place:

• A Keeper Secrets Manager application is configured and operational
• A KeeperPAM Gateway is deployed and can reach the identity provider APIs
• Workflow is enabled for approval and time-bound access
• A PAM Configuration exists for a supported identity platform
• The target user exists in both Keeper and the identity source
• The target group, role, or entitlement already exists in the identity platform
• The target cloud account, tenant, or application already trusts that identity platform
• The Gateway has outbound network access, DNS resolution, and HTTPS connectivity to the required endpoints

If you use federated access, confirm the trust relationship between the target platform and the external identity provider is working before enabling Privileged Cloud.

Identity Modes

Privileged Cloud supports two identity modes. When a request is submitted, KeeperPAM applies the elevation through one of the following paths:

Direct identity mode — KeeperPAM communicates directly with the identity system defined in the PAM Configuration. Use this when the target platform manages its own identities and roles.

Federated identity mode — KeeperPAM routes the request through a separate identity provider configuration. Use this when the target platform relies on an external IdP for authentication or entitlement mapping. To enable, turn on Federated Identity in the PAM Configuration and select the separate PAM Configuration that points to the external IdP. KeeperPAM applies the temporary identity change in the federated directory, then lets the target platform evaluate that change through its normal SSO or federation path.

For a full list of supported platforms, see Supported Identity Platforms.

Visit the Keeper Privilege Cloud docs to learn more.

Improvements

• VAUL-9031: Add zero-state screen for CNAPP Cloud Security
• VAUL-9034: Enhance Manage Access and Enable JIT from Remediate Action modal
• VAUL-9072: Add new CNAPP Remediation Action — Remove Standing Privilege
• VAUL-7557: Audit dependencies
• VAUL-9035: Update wording on CNAPP modals for "Enable JIT" and "Manage Access"
• VAUL-9047: Update record/folder selected state in dark mode
• VAUL-9081: Fix CNAPP fields showing on both "General" and "Features" tabs
• VAUL-9089: Resolve vault SBOM vulnerabilities
• KDE-2119: Allow folder names to span 2 lines of text
• KDE-2137: Resolve desktop SBOM vulnerabilities

Bug Fixes

• VAUL-8831: Permission error message when clicking Share button on non-KD account
• VAUL-8869: Sharee with "Can Manage Records" in classic SF missing disabled fields for KD account
• VAUL-8870: Sharee with "Can Manage Users" in classic SF missing disabled fields for KD account
• VAUL-8893: Error message when clicking Share in record options menu on non-KD account
• VAUL-9007: CNAPP issue stays in "Requires Attention" when rotation fails without resolution submission
• VAUL-9025: Cloud Security titles, tags, and severity not translated
• VAUL-9033: Japanese translation misses
• VAUL-9053: Team Name and View Team link on same line; missing space beneath My Folders label
• VAUL-9060: PAM rotating SSH Admin with private key failing
• VAUL-9062: Add missing restricted-to-share message in KD GRE
• VAUL-9076: Fix zero state for Cloud Security
• KDE-2088: LastPass Shared Folders fail to import via Automated Import
• KDE-2123: Linux Fedora checksum errors when updating to 18.2.1
• KDE-2134: Microsoft Defender ASR blocking bootstrap executable from Microsoft Store install path

Web Vault Update Instructions

To ensure you're using the latest Web Vault, simply reload the vault login page (or Shift+Ctrl/Cmd+R to force refresh)

Desktop Update Instructions

If you installed Keeper Desktop directly from the Keeper website, download the latest version from: https://www.keepersecurity.com/download.html?t=d

If you installed Keeper Desktop from the Mac App Store or Microsoft Store, visit the store to perform the update.

Original source

New Features

KeeperAI PAM Connection Settings

pam connection ai

New command to manage KeeperAI settings on PAM resources and remote browser instances. Supports show, set, unset, and remove operations for AI configuration on PAM connections.

PAM Gateway Online Filter

The command

pam gateway list

now accepts

--online (-o)

to filter results to only online gateways, along with gateway totals in the output.

Enterprise MSP Transfer

Added support for transferring a managed company to another MSP. The backend will be live next week in production to support this command.

Thycotic Import: Selective Secret IDs

import --format thycotic

now accepts

--secret-ids

(comma-separated) to import or inspect specific secrets by ID — useful for debugging cases where the Thycotic lookup API omits secrets due to security policies.

KCM: Port Mapping Defaults and Empty User Handling

KCM export now supports connections with empty user or port fields: missing ports fall back to protocol defaults (configurable via KCM_mappings.json), connections missing a user are logged for follow-up, and allow-file-uploads is available for RBI connections.

Bug Fixes

Fixed a SQL injection vulnerability in legacy Commander MSSQL password rotation and added input validation to reject unsafe --password values.

Fixed an issue where

pam rotation edit

did not correctly apply SaaS profiles.

Fixed the permission-check rotation request for IAM user links — configurationUid, matching revision, and an explicit empty resourceUid are now sent to correctly handle IAM rotation semantics.

NSF Share Expiration and Folder Labels

Fixed expiration updates for

nsf-share-folder

and

nsf-share-record

Enforced a one-minute minimum on NSF and classic share expiration

Standardized list/search record_category output to lowercase (classic/nested)

Renamed Supershell Drive folder labels to Nested Shared Folder (Shared) and Nested Shared Folder (NonShared)

Nested Shared Folder - Record Add/Update Policy Enforcement

The

nsf-record-add

and

nsf-record-update

commands now enforce GENERATED_PASSWORD_COMPLEXITY and RESTRICT_RECORD_TYPES enterprise policies.

Original source

KEPM Agentic AI Governance - Admin Console Support

Admin Console version 17.10.0 introduces KEPM Agentic AI Governance v1, a major update to Keeper Endpoint Privilege Manager that extends privilege management to AI agent identities. This release delivers a redesigned KEPM dashboard, a new dedicated Agentic AI collection type, Agentic AI tagging within Application collections, and an enhanced policy creation experience.

To learn more about Keeper Endpoint Privilege Manager click here.

Keeper Endpoint Privilege Manager now supports governance of Agentic AI identities alongside traditional human and machine accounts. Administrators can define, manage, and apply privilege policies to AI agents directly from the Admin Console, with full visibility into AI agent risk scores, policy enforcement status, and activity.

• New AI dashboard — real-time overview of open requests, high-risk events, registered endpoints, high-risk AI identities, over-privileged agents, and policy activity
• Agentic AI collections — a dedicated collection type for grouping and governing AI agent identities, separate from standard user accounts
• Agentic AI tags in application collections — AI-driven applications are now tagged with an Agentic AI pill within the existing Applications collection view
• Updated policy creation — redesigned policy screen with enhanced required access control options

Original source

Improvements

DR-1208: Implement IdP configuration linking in PAM Configurations
DR-1214: Azure force provision user properties (group / role)
DR-1253: Support for IdP authentication with PAM machines and PAM databases
DR-1250: Support linking identity provider PAM configuration to another PAM Configuration
DR-1249: Validation for privilege elevation on Active Directory
DR-1277: USS: Support option for plaintext secrets
DR-1283: Improvements to Services and Scheduled Tasks

Bug Fixes

PG-235: Resolved issue where gateway lacked configuration validation for excessive JIT login delay
PG-308: Resolved issue where DB Proxy session recordings don't work with sourcing files
PG-314: Resolved issue where KeeperDB proxy MySQL query logs empty/unreadable with JDBC clients (e.g. DBeaver)
PG-345: Resolved issue where JIT elevation times out on large AD environments due to full group enumeration
PG-351: Resolved issue where launching KeeperDB ignores the credential selected from the launch dropdown

Update Instructions

Please visit the Keeper Gateway documentation for your specific platform:

Original source

Keeper Browser Extension version 18.0.0 introduces support for Nested Shared Folders and BreachWatch along with various performance improvements and bug fixes.

Nested Shared Folders With Role-Based Folder Permissions

Keeper is redefining how users and teams organize, share and protect their most sensitive records. With the introduction of Nested Shared Folders with Role-Based Folder Permissions, we’ve rebuilt the vault’s folder, sharing and permissions model from the ground up, delivering a more flexible and scalable experience for every user and team.

Role-Based Folder Permissions give administrators granular control over exactly who can view, edit, share and manage content at every level of the folder hierarchy — whether you're an individual user, managing a small team, or operating across a global enterprise.

During this transition, the new Nested Shared Subfolder system will exist alongside the existing Classic folder system and permission model, with two distinct folder icons to help users easily differentiate between them.

This feature is currently available by invitation only. To learn more and request access, please see our end-user guide, contact your Keeper representative or visit keepersecurity.com/contact.

User Experience

Within the browser extension, users can now add new and existing records to any newly created folders within the Nested Shared Folders system and all associated permissions will apply consistently across clients.

Classic and Nested Shared folders are easily distinguished by two distinct folder icons — Nested Folders display as solid in color, while Classic folders appear with a transparent icon.

Improvements

• BE-7072: Performance improvements for vaults that have hundreds of entries mapped to the same domain.
• BE-7447: Added support for BreachWatch in the Keeper Browser Extension. BreachWatch is a powerful, secure add-on that monitors the internet and dark web for breached accounts matching your Keeper Vault records, alerting you to take immediate action, including changing your password at the affected website to protect yourself against hackers.

Bug Fixes

• BE-7685: Newly shared records do not always appear while user is actively logged into the extension.
• BE-7659: Form filler iframe popup is not clickable when login modal opened.
• BE-7655: Device Approval screen fails to load if SSO account requires device approval.
• BE-7644: When user has multiple records for same URL, clicking "Launch" from URL field on detailed view on record B fills credentials from record A if A has Autofill ON.
• BE-7466: When user has multiple records for same URL, clicking "Launch" from detailed view on record B fills credentials from record A if A has Autofill ON.
• BE-7611: Click-and-drag to secondary monitor causes popups to flicker or disappear (Firefox).
• BE-7578: Master password reveal then left click behavior in Windows is non-standard (single vs double click).
• BE-7479: Manual Sync fails to update role enforcement policy changes.

Original source

Improvements

VAUL-7523: Several front-end enhancements to improve the user experience around managing linked services after a password rotation occurs.
Visit the Windows Services and Scheduled Tasks docs to learn more.

VAUL-8883: Enhanced the front-end UI to directly configure JIT access from the CNAPP Remediate Action modal screen.
Visit the Cloud Security docs to learn more about CNAPP integrations

VAUL-8944: Added ability to configure Manage Access from the CNAPP Remediate Action modal screen.

VAUL-9005: Implemented trashcan sync and restore for Nested Shared Folders and records.

VAUL-9003: Implemented move command for Nested Shared Folders and records.

VAUL-9002: Implemented "Deny" option on inherited folder access in Nested Shared Folders.

VAUL-9016: Folder names now display up to two lines of text before truncating, to acommodate for very long folder names.

VAUL-9044: Long folder names are now properly truncated in Create New Record, Legacy Folder Detail, and KSM Detail views.

VAUL-9015: Added Applications tab to nested shared subfolders in the Secrets Manager UI.

VAUL-8905: Refactored and consolidated legacy and new record permissions (Phase I).

VAUL-8381: Users can now select existing shared folders when creating a gateway during onboarding.

Bugs

VAUL-8963: Fixed an issue where user supplied credentials were not sent correctly for RBI sessions.

VAUL-9054: Fixed an issue where non-KeeperDrive enterprise vaults were using KeeperDrive record-create commands, causing records to vanish.

VAUL-9055: Fixed an issue where KeeperDrive folders could not be shared to teams.

VAUL-8701: Fixed an unexpected EncryptedDataKeyType.NO_KEY error when logging in with biometrics on a different browser.

VAUL-8972: Fixed an issue where discovery rules were not always saved in the web vault.

VAUL-8998: Fixed missing "Risk Type" information on the CNAPP Vulnerability Details screen.

VAUL-9023: Fixed CNAPP Cloud Security filter counts not updating correctly when filter options are changed.

VAUL-9039: Fixed a broken link in the "Enable JIT flow for CNAPP" remediation.

VAUL-9032: Fixed incorrect label styling in Rotation Settings.

VAUL-8371: Fixed an issue where the PAM graph did not always sync for resources and users without configuration access.

VAUL-8908: Fixed the share dialog title not truncating with an ellipsis for long names.

VAUL-8897: Fixed search returning no results when searching by KeeperDrive folder name or UID.

VAUL-8824: Fixed several design mismatches when editing a folder name in KeeperDrive.

VAUL-8691: Fixed an issue where creating a new shared subfolder in a large vault did not auto-focus on the newly created folder.

VAUL-8807: Fixed missing error message when attempting to add an existing KeeperDrive record to a KeeperDrive folder.

Web Vault Update Instructions

To ensure you're using the latest Web Vault, simply reload the vault login page (or Shift+Ctrl/Cmd+R to force refresh)

Desktop Update Instructions

If you installed Keeper Desktop directly from the Keeper website, download the latest version from:
https://www.keepersecurity.com/download.html?t=d

If you installed Keeper Desktop from the Mac App Store or Microsoft Store, visit the store to perform the update.

Original source

The Keeper Security Workflow app allows organizations to manage privileged access directly within ServiceNow, enabling users to request and approve access to secrets, credentials, and systems. This integration provides just-in-time (JIT) access without standing privileges, supporting secure workflows.

Key features

• Endpoint Privilege Manager Approvals
• Request Access To Record/ Folder
• Store Records To Keeper Vault

Release notes

• Support for Nested Sub Folder permission types
• Support for password rotate on expire for PAM record types
• Detailed record description and type in search modal

Requirements

• Service Catalog Platform
• Keeper Security ITSM Application (Optional)

Original source

Gateway 1.8.3 delivers Scheduled and Services improvements, Universal Secret Sync tag-writing enhancements, and a fix for Remote Browser Isolation session rejections.

Improvements

DR-1204: Scheduled and Services discovery and rotation propagation improvements

DR-1275: Universal Secret Sync - Write title and keeperRecordType attributes to resource tags instead of secret attributes

Bug Fixes

PG-332: Resolved issue where RBI userSupplied sessions rejected due to wrong settings key lookup

Update Instructions

Please visit the Keeper Gateway documentation for your specific platform:

Original source