Keeper Release Notes

Overview

Admin Console 17.11.3 introduces user interface support for Node Isolation, new Role Enforcement Policies for Passkey Authentication controls, and Endpoint Privilege Manager enhancements, alongside improved SCIM team visibility and critical Government Cloud bug fixes.

New Features

Node Isolation

We've added the ability to enable or disable Node Isolation directly from the Admin Console under Admin > Node Options, allowing you to restrict visibility between sibling nodes without requiring commands to be run through the Keeper Commander CLI.

Passkey Authentication Role Enforcement Policies

Added Enforcement Policies to control whether Passkey Authentication is enabled and specify which authentication methods users can use, including security keys and biometrics.

Improvements & Bug Fixes

• EM-9118 - Added a Keeper 101 Video on the "Getting Started" page for KeeperDB.
• EM-9159 - Added a search filter to Nodes for easier navigation.
• EM-9082 - Added an "Invited" tab to Teams to display SCIM-provisioned users who have not yet accepted their invitation.
• EM-8795 - Added an error message when creating a Role or Team name that goes over the maximum amount of characters.
• EM-7773 - Added the edit option after verifying and saving Email Auto-Provisioning.
• EM-9146 - Added tooltips to all the KeeperPAM Enforcement Policies.
• EM-9104 - Improved the User Status Report download filename to include the report name and date.
• EM-8761 - Fixed an issue where newly created Roles were not automatically selected by default upon creation.
• EM-8680 - Fixed an issue with the Government Cloud environments showing the Risk Management Dashboard scores not tabulating for certain users.
• EM-8327 - Resolved an issue where the BreachWatch section is not appearing on the dashboard for Managed Companies.
• EM-8472 - Fixed an issue with Endpoint Privilege Manager where custom policy types were not sorted correctly.
• EM-8970 - Fixed an issue where the "Stay Logged In" toggle was not working correctly after a page reload.
• EM-9226 - Fixed an issue where a Managed Service Provider could not download a Compliance Report for a Managed Company.
• EM-9191 - Fixed the Endpoint Privilege Manager Deployment token domain for Government Cloud environments.

Original source

Bug Fixes

VAUL-9567, KDE-2317: Fixed an issue with Nested Shared Folders where revoking a user’s access to a parent folder would also remove their independently granted access to child folders.

Web Vault Update Instructions

To ensure you're using the latest Web Vault, simply reload the vault login page (or Shift+Ctrl/Cmd+R to force refresh)

Desktop Update Instructions

If you installed Keeper Desktop directly from the Keeper website, download the latest version from:

If you installed Keeper Desktop from the Mac App Store or Microsoft Store, visit the store to perform the update.

Original source

This release adds Kerberos authentication for Active Directory Protected Users. It also hardens database and browser-isolation sessions, updates core dependencies, and fixes the Connection Import layout.

New features and improvements

KCM-281: Kerberos Authentication for Active Directory "Protected Users"

• Added Kerberos authentication support for RDP sessions via FreeRDP, enabling accounts in Active Directory's high-security Protected Users group to authenticate.
• Configured containerized guacd to maintain Kerberos ticket caches in memory per connection process (KRB5CCNAME=MEMORY:), ensuring credentials are not shared and avoiding Linux kernel keyring restrictions in container environments.

KCM-614: Chromium / CEF Upgrade for Remote Browser Isolation (RBI)

• Upgraded kcm-libcef to Chromium Embedded Framework (CEF) 152 to maintain compatibility with modern web standards, improved stability, and file upload/download flows within isolated browser sessions.

Security fixes

KCM-612: Restriction of PSQL Arbitrary Reconnection and Credential Forwarding

• Removed support for the PostgreSQL \c (connect) command in interactive database sessions to prevent users from redirecting connections or inadvertently exposing connection credentials to unauthorized external destinations.

KCM-609: Hardened Database-Type Connection Shell Execution

• Disabled vi-histedit and Emacs runtime command rebinding (ed-command / Meta-x) within libedit during database connection sessions. This mitigates risks of external process or shell invocation (such as executing commands from ~/.exrc) under the guacd user context.

KCM-610: WebAuthn Origin Validation in RBI

• Resolved an issue in Remote Browser Isolation where origin verification for WebAuthn authentication was not properly enforced.

KCM-620: Security Patching for libssh2

• Backported and applied security patches for critical and high-severity CVEs affecting libssh2 used in SSH and SFTP connections.

KCM-613: Third-Party Dependency Vulnerability Remediation

• Updated key system packages and dependencies (including FreeRDP and libvncclient) to their latest secure compatible releases to resolve known CVEs and maintain a clean SBOM.

Bug fixes

KCM-589: Connection Import Dialog Layout Fix

• Fixed an issue where the license expiration notification banner displaced action buttons on the Connection Import screen. The banner now overlays cleanly, can be dismissed, and does not interfere with the Cancel or Import Connections buttons.

Original source

Security

KC-1471: Prevent newline injection in connect command prompts. Control characters are now escaped and shell comments handled, closing a path where an operator with Can Edit on a shared record could hide commands in a confirmation prompt and exfiltrate device credentials without being noticed.

KC-1462: Validate record ownership in the audit-log command. Only operator-owned records are now eligible as an export destination, preventing an attacker from hijacking an export by sharing a malicious record with a matching title. Also removes TLS verification bypass from Splunk exports.

Features

KC-1442: Add Classic-to-NSF conversion command, with negative-flow tests and support for skipping records that are already nested-share.

DR-1324: Generate and deliver tokens.

Improvements

KC-1461: Limit NSF folder depth on import, with a sibling-flatten fallback and a structure report when limits are exceeded.

Improve LoadRecordTypes command: continues past invalid custom record types instead of aborting, with more verbose and color-coded logging.

Add filtering while printing inherited and denied-access permissions for folders and records.

Fixes

Fix folder properties mutation bug in the NSF share-folder command.

Fix service mode response status.

Fix SaaS field check incorrectly flagging non-required blank values.

Original source

Breaking changes

Node.js 22 or later required: @google-cloud/kms 6.x requires it, and engines.node now declares >=22. Upgrade Node.js before you upgrade this package.

The config directory must be writable: The atomic write creates a temp file next to the config file, so a config file inside a read-only directory now fails with EACCES. Make the directory writable.

A symlinked config path is no longer supported: Reads and writes both reject one with an error that names the path. Point keyVaultConfigFileLocation or KSM_CONFIG_FILE at the real file.

Updates

• KSM-1553: The package now loads under Yarn Plug'n'Play and pnpm with hoist: false. It no longer imports the undeclared google-auth-library directly.
• KSM-1524: getToken() no longer resolves to undefined on the Application Default Credentials path, which sent RAW_ENCRYPT_DECRYPT keys down the wrong crypto path. A failed token request now rejects with an error that carries only the message.
• KSM-1370: createConfigFileIfMissing() recreated the config file on any fs.access failure. It now recreates only on ENOENT; other failures propagate instead of overwriting the file.
• KSM-1450, KSM-1458, KSM-1508: Config writes are now atomic, so a crash mid-write can no longer leave a truncated config. A failed directory fsync no longer fails the write.
• KSM-1455, KSM-1486: loadConfig() and decryptConfig() now throw on a zero-length config file instead of silently re-encrypting it as empty.
• KSM-1457: A blank KSM_CONFIG_FILE environment variable or keyVaultConfigFileLocation option now falls back to the next config source, instead of resolving to the current working directory.
• KSM-1459, KSM-1507: saveConfig() no longer skips recreating the config file when it was deleted mid-process. Only ENOENT counts as deleted; any other access failure now rejects the save.
• KSM-1460: A KMS failure during config auto-encryption now reports as a KMS error instead of a damaged config file.
• KSM-1461: A failed changeKey() now rolls back the key type and encryption algorithm along with the key config, instead of leaving the config permanently undecryptable.
• KSM-1516: Every public method except init() now rejects until init() has completed.
• KSM-1515: loadConfig() now rejects a parsed config that isn't an object of string values, before any write.
• KSM-1514: The SDK now refuses a symlinked config path on read and on write, closing a path where a planted symlink could feed the SDK an attacker-chosen credential file.
• KSM-1533, KSM-1563: Raised the declared axios floor to ^1.20.0, resolving known advisories, including a high-severity one that covers every release through 1.19.0, on the bearer-token requests this package makes to GCP Cloud KMS.

Resources

• npm package
• JavaScript SDK Documentation

Original source

New Features

Nested Shared Folder Account Transfer: Enterprise administrators can now transfer departing user accounts containing Nested Shared Folder files, directories, and nested folder structures directly into a designated container folder in the recipient's vault, preserving access permissions and decryptability.

On-Demand Permanent Deletion & Empty Trash: Users can permanently delete selected records and purge their entire trashcan in a single action, ensuring complete removal of deleted items and attachments while respecting enterprise retention rules.

Privileged Access Management (PAM) Workflow Audit Logging: Comprehensive ARAM audit logging is now available for Privileged Access Management workflows, recording access request submissions, session checkouts, and session check-ins.

Keeper Secrets Manager (KSM) Integration with Nested Shared Folder: Expanded Secrets Manager capabilities allow automated clients to create, update, and delete secrets and folders located directly within Nested Shared Folder shared folders based on user permissions.

Granular Delegated Admin Permissions for Automator: Added stricter administrative access controls requiring the "Perform Device Approvals" privilege in addition to node management to configure or manage Keeper Automator instances.

Real-Time Role Enforcement Updates: Client vaults now receive prompt notifications when administrative role enforcement policies change, immediately synchronizing policy changes across active sessions.

Improvements

KA-6786: Adds real-time notifications to client applications whenever administrator role enforcements are updated. Allows client sessions to immediately reflect policy changes without requiring a manual logout or app restart.

KA-8218: Enables sharing of Nested Shared Folder folders directly with integrated applications through existing application share workflows. Ensures seamless compatibility when managing access permissions across both standard and Drive shared folders.

KA-8283: Enables Keeper Secrets Manager clients to delete secrets stored within Nested Shared Folders based on user permissions. Ensures proper authorization checks and consistent status responses during automated secret cleanup operations.

KA-8284: Allows Keeper Secrets Manager integrations to update folder properties within Nested Shared Folder directory structures. Enforces granular folder-level edit permissions to ensure secure folder management via API.

KA-8285: Adds support for automated folder creation inside Nested Shared Folders via Keeper Secrets Manager. Ensures newly created subfolders inherit appropriate access rights and encryption context seamlessly.

KA-8329: Enables Keeper Secrets Manager to delete folders located within Nested Shared Folder directories when permitted. Validates folder access rights and returns individual status outcomes for mixed deletion batches.

KA-8355: Allows Keeper Secrets Manager to create new secrets directly inside designated Nested Shared Folders. Ensures newly created secrets adhere to folder permissions and zero-knowledge encryption standards.

KA-8629: Enables enterprise administrators to securely transfer vault contents from departing employees to designated recipients. Preserves vital corporate records, folder hierarchies, and permissions while maintaining Keeper’s zero-knowledge security architecture.

KA-8742: Enterprise account transfers with Nested Shared Folders now place transferred content in a dedicated top-level folder in the recipient’s drive, keeping the recipient’s root directory organized and preserving clear file provenance.

KA-8744: Preserves Nested Shared Folder content, nested folder hierarchies, and file permissions during enterprise account transfers. Consolidates transferred Drive resources into a single recipient folder, ensuring immediate accessibility without orphan files.

KA-8916: Introduces a secure key rotation mechanism for session token encryption. Enhances backend cryptographic hygiene and operational security without interrupting active user sessions.

KA-9021: Enhances the account transfer service to support designated destination folders for Nested Shared Folder assets. Ensures all transferred folders and records are systematically organized during user offboarding workflows.

KA-9109: Introduces a user-initiated "Empty Trash" feature and selective permanent deletion for individual records and folders. Ensures complete purging of deleted items and attachments while enforcing organization retention and removal policies.

KA-9144: Hardens the permanent deletion sequence to ensure removal signals are broadcast before access teardown. Prevents residual ghost folders from lingering in user vaults following permanent folder deletion.

KA-9145: Grants recipient accounts full ownership and decryption capabilities for all nested Nested Shared Folder records during account transfers. Ensures transferred nested records can be managed, restored from trash, and re-shared by the recipient seamlessly.

KA-9149: Adds new Admin Console audit log events for Privileged Access Management workflow session start and end activities. Gives administrators full audit trail tracking for user checkout and checkin actions on privileged records.

KA-9158: Improves database connection routing during folder operations to maintain strict transactional consistency. Ensures high data integrity and reliability during concurrent folder updates and permission changes.

KA-9171: Enhances user deletion processing by snapshotting affected collaborator lists when deletion is initiated. Guarantees that retry attempts continue to notify all relevant collaborators promptly without missing sync events.

KA-9473: Introduces cryptographic payload signing on outbound requests sent to Keeper Automator instances. Strengthens communication security and verifies the authenticity of automated administrative actions.

KA-9502: Resolves event-handling errors encountered during cloud-native application protection audit event logging. Ensures continuous, error-free ingestion and reporting of security audit events.

KA-9577: Adds Admin Console audit event logging for user-submitted privileged access workflow requests. Enables administrators to monitor and report on access request submissions across protected enterprise records.

Bugs

KA-8961: Fixed an issue where parent folder references continued to sync to client vaults after access was revoked. Ensures user vaults cleanly remove revoked parent folders while properly maintaining explicitly granted child folders.

KA-8965: Fixed an API error where sharing records without required encryption keys returned a server error instead of a validation error. The endpoint now returns a clean bad request response, improving client-side error handling and diagnostics.

KA-8966: Fixed an API issue where providing an invalid or truncated record key triggered an unexpected server failure. Requests with invalid key parameters are now properly validated and return appropriate client-side error codes.

KA-9017: Resolved an issue where revoking access to a parent folder inadvertently removed user access from nested folders. Child folders with explicit, independent user permissions now remain accessible in the user’s vault as expected.

KA-9071: Fixed a defect where deleting Nested Shared Folder records via Secrets Manager prevented them from appearing in the trashcan. Deleted Drive records now correctly move to the owner’s trash folder and are available for recovery.

KA-9077: Resolved an issue where expiration of a Privileged Access Management trial incorrectly disabled standalone add-on licenses. Active standalone licenses for Secrets Manager, Connection Manager, and Remote Browser Isolation now remain active.

KA-9132: Fixed an issue where records deleted by a Full Manager did not automatically update in the record owner’s vault. Vault synchronization now immediately reflects shared record deletions across all participants without requiring a manual sync.

KA-9172: Resolved an issue where secrets granted via direct application shares remained accessible via Secrets Manager after deletion. Trashed Nested Shared Folder records are now properly hidden from secret retrieval until restored by an authorized user.

KA-9298: Ensured shared folder record removal restrictions are properly enforced for Nested Shared Folder records in Secrets Manager. Prevents automated or restricted clients from deleting records from shared folders when policy restrictions apply.

KA-9471: Fixed an access control oversight by requiring the "Perform Device Approvals" administrative permission for Automator management. Ensures delegated administrators can only configure and manage Automators on nodes where they hold explicit approval authority.

KA-9535: Optimized vault synchronization queries for Nested Shared Folder records by eliminating unnecessary data payload fetching. Significantly reduces data transfer overhead, lowering network latency and improving sync responsiveness.

KA-9551: Resolved an issue where performing consecutive folder moves within deep folder structures disrupted subsequent vault syncs. Folder hierarchy reorganizations now maintain consistent folder positioning and accurate synchronization state across clients.

KA-9596: Fixed an input validation issue where removing an account from the account switch list succeeded even with an empty username. The API now validates the username parameter and returns a bad request response when required fields are missing.

KA-9611: Fixed a synchronization issue occurring after repeatedly toggling user permissions on nested shared folders. Ensures that restoring folder access after prior revocations properly updates client vaults and folder visibility.

Original source

This release adds KeeperPAM proxy and import capabilities. It also strengthens Service Mode and enterprise permission checks. Several reliability fixes are included.

Highlights

• Added KeeperRDP and KeeperSSH Proxy support for PAM tunnels, alongside KeeperDB Proxy. Use pam tunnel start --proxy to select the applicable resource proxy. Use --credential to override the linked RDP or SSH credential when permitted. Proxy-ready messages now appear after connection.
• Added pam tunnel edit --keeper-proxy on|off|default for supported resource protocols. Improved tunnel discovery, cross-process cleanup, proxy diagnostics, and ephemeral JIT credential handling.
• Added Nested Shared Folder support to CyberArk PAM project imports with --nsf. Imports include folders, records, rotation, and PAM configuration. They can also match an existing shared folder by UID.
• Added HashiCorp Vault PAM configuration through pam config new/edit --environment hashicorp. Configure the Vault URL, token, namespace, mount path, and HashiCorp ID.

Security and access controls

• Service Mode now blocks access to its own configuration records. It also protects integration configuration records, including SailPoint configuration. App-setup commands are restricted to their allowlists. Variable expansion cannot bypass the SailPoint command guard.
• Delegated administrators cannot grant or revoke sensitive enterprise privileges they do not hold. PAM gateway creation and removal now enforce the allow_pam_gateway policy, including legacy commands.
• Sensitive typed-record values are masked in record-add, record-update, debug, and Service Mode API logs.

Fixes and improvements

• Fixed stale revision errors when editing PAM rotation by refreshing the cache. Restored the gateway name in pam rotation info.
• Fixed Service Mode background operation and tunneling on Windows.
• Fixed truncated application_info and account_info fields in epm approval list JSON and CSV output.
• Fixed an incorrect “Supported columns” warning for base fields in enterprise-info.
• Improved enterprise root-node renaming, display-name handling, and root-node visibility.
• Added an optional path-aware mode for keeper-dag edges. Edges on different paths are no longer inadvertently deactivated.

Original source

Keeper SSO Connect On-Prem version 17.1.4 delivers critical security enhancements, administrative interface hardening, Windows environment access control improvements, and third-party library updates.

All administrators operating SSO Connect On-Prem instances are encouraged to upgrade to version 17.1.4.

Improvements

• KSC-535: Administrative Interface Security Hardening
  Implemented comprehensive protections across all management endpoints to protect administrative configuration.
• KSC-556: SAML Endpoint Hardening
  Strengthened verifications on SAML authentication callbacks with trusted endpoints.
• KSC-539: Windows File System Access Lockdown
  Restricted file system permissions (ACLs) on Windows installations for SSO Connect configuration, log, and keystore directories to administrative and system service accounts only.
• KSC-557: Third-Party Component & Dependency Updates
  Upgraded underlying third-party dependencies to remediate reported component vulnerabilities and maintain a secure software supply chain.
• Code Quality & Static Analysis Remediation
  Addressed CodeQL security findings and performed code-level optimizations to improve stability and maintainability.
• Information Disclosure Mitigation
  Suppressed runtime server version banners from HTTP response headers.

Compatibility & Upgrade Notes

• Configuration Changes: No administrative configuration or IdP schema changes are required.
• Automatic ACL Updates (Windows): Upgrading on Windows automatically updates directory permissions on existing data and log folders.
• Deployment Validation: It is recommended to perform a test sign-in with your Identity Provider (e.g., Microsoft Entra ID / ADFS, Okta, PingFederate, Keycloak) after upgrading.
• Supported OS: Windows Server 2022/2025, Red Hat Enterprise Linux 6.8+, Ubuntu 16.04+, openSUSE 15.0+
• Java Runtime: Java 17 LTS

Update Instructions

If you are performing a regular update of SSO Connect On-Prem (from a recent version):

• Open the Admin Console and visit the privisioning tab of the node
• Download, unzip and run the installer

Original source

Web Vault 18.6.4

Web Vault 18.6.4 focuses primarily on CNAPP (Cloud-Native Application Protection Platform) and introduces Tenable as a new integration partner alongside Wiz, featuring a dedicated setup modal, mapping of Tenable issues to the Cloud Security schema and status management capabilities. This release also includes a redesigned Vulnerability Details screen, a new search feature for CNAPP issues, enhancements to the Remove Standing Privilege remediation flow including group and role listing, and several bug fixes.

Keeper now integrates with Tenable to streamline the remediation of cloud security findings. Tenable identifies exposed identities, risky access paths, and cloud misconfigurations — and this integration allows those findings to flow directly into Keeper Cloud Security where they can be acted on immediately.

Once a finding is sent to Keeper, teams can remediate it using KeeperPAM controls including credential rotation, managed onboarding, and privileged access management. Remediation status stays synchronized across both platforms, giving security teams a single, consistent view of what has been resolved and what still needs attention.

Once the integration is configured, any vulnerabilities identified by Tenable will appear in Keeper's Cloud Security Dashboard, complete with the full resource details required to remediate the issue.

Once you reviewed the vulnerability details you can choose between four remediation actions:

• Rotate Credential
• Manage Access
• Enable JIT Access
• Remove Standing Privilege

To onboard the resource required to remediate the issue, select the appropriate record type for the resource you wish to onboard (PAM database, machine, directory, remote browser and cloud) and begin the remediation.

After remediation is complete, Keeper automatically syncs with Tenable, and the resolved status appears in both platforms without any manual intervention.

For setup instructions and more detailed information for Keeper's Tenable integration, click here.

Improvements

• VAUL-9346: Added a dedicated CNAPP integration setup modal for Tenable
• VAUL-9345: Mapped Tenable-specific findings onto the Cloud Security schema
• VAUL-9408: Added support for setting the status of Tenable issues
• VAUL-9440: Added a popup notification when updating a CNAPP issue's status fails or results in an unexpected status
• VAUL-9449: Implemented search functionality on the Cloud Security screen to quickly find CNAPP issues
• VAUL-9215: Added a download button for the Encrypter docker-compose.yml file on the CNAPP Setup modal
• VAUL-9395: Enhanced the "Remove Standing Privilege" flow
• VAUL-9430: Refined the Vulnerability Details multi-step wizard UI
• VAUL-9434: Improved the Vulnerability Details modal and PAM settings with larger action buttons, disabled auto-collapsing sections and retry controls
• VAUL-9454: UI refinements across the Cloud Security screen, including forced status refresh and duplicate role name validation
• VAUL-9455: Updated dependency for the Web Vault application

Bug Fixes

• VAUL-9291: Fixed an issue where the selected PAM configuration was not persisting on the vulnerability details screen
• VAUL-9309: Resolved an issue where clicking outside the Tags filter or PAM Configuration dropdown failed to close the dropdown
• VAUL-9456: Fixed the Encrypter connection verification link in the CNAPP integration setup to resolve a 401 API token error

Web Vault Update Instructions

To ensure you're using the latest Web Vault, simply reload the vault login page (or Shift+Ctrl/Cmd+R to force refresh).

Desktop Update Instructions

If you installed Keeper Desktop directly from the Keeper website, download the latest version from: https://www.keepersecurity.com/download.html?t=d

If you installed Keeper Desktop from the Mac App Store or Microsoft Store, visit the store to perform the update.

Original source

Integration Center & API Keys

Integration Center Hub

Added a dedicated Integration Center tab to the Admin Console, enabling administrators to discover, and search for enterprise connections across AI, SSO, SCIM, SIEM, IGA, SPM, ITSM, Developer Tools Keeper Services, and other key categories.

The new Integration Center displaying popular integrations categorized by service type.

Integration API Key Management

Introduced an API Keys sub-tab within the Integration Center, allowing administrators to generate, view, sort, and manage API keys for enterprise integrations directly within the Admin Console.

The API Keys tab displaying generated integration tokens with expiration dates and status indicators.

Enhancements to Advanced Reporting & Alerts Module (ARAM)

Parent Category Folders

The "Event Types" search filter now includes parent category folders, making it easier to find and select events for audit reporting.

Event Types search dropdown displaying parent category folders and filtered session event results.

Added "KeeperAI" Event Types

Added KeeperAI event type filters for granular Reporting to track: session recording status changes, session termination, threat-level session locking, and session unlocking.

Nodes and Reporting

Reporting now includes Node details for improved user activity tracking across enterprise nodes.

Improvements

• EM-7788: Added new Enforcement Policy within "Account Settings" to warn or block users from saving records with personal emails in business vaults, or work emails in personal vaults.

Bug Fixes

• EM-8003: Resolved an issue where long node names were truncated incorrectly in administrative selection views.
• EM-8512: Corrected an issue where team member lists failed to refresh automatically upon adding or removing users.
• EM-8721: Fixed a bug causing policy date range pickers to accept improperly formatted manual entries.
• EM-8930: Resolved display borders appearing incorrectly inside dropdown selector menus.
• EM-9092: Fixed missing toast notifications when performing bulk updates across user rows.
• EM-9102: Corrected an issue preventing proper error messages from displaying on failed invitation updates.

Original source

Gateway 1.8.10 introduces support for CNAPP/Tenable integration and fixes a Windows service startup failure introduced in 1.8.9, along with two CNAPP-related bugs affecting AWS standing privilege removal and group and role reloads.

Bugs

PG-450: Issue where Gateway 1.8.9 Windows service fails to start due to click-repl 0.4.0 calling sys.stdin.isatty() at import

DR-1390: Issue where CNAPP AWS Remove Standing Privilege fails when removing an attached policy

DR-1391: resolved Gateway errors occur when reloading Groups and Roles

Please visit the Keeper Gateway documentation for your specific platform:

Original source

Available in Open Beta

Enhancements

AN-7922: Introduces a new Session Management UI that allows you to view and manage all devices connected to your account. From this new interface, you can see detailed information for each registered device, such as the specific model name, operating system, and last login time. You now have the power to remotely lock a device, log out active sessions, or completely remove old devices to keep your vault secure.

AN-9118: You can now respond to Just-in-Time access requests directly from your Android notification center. When a team member requests temporary privileged access, approvers see the requester's name, their justification, the related ticket number, and the requested duration, and can approve or deny the request without opening the app.

AN-9121: Easily import your passwords and passkeys directly into Keeper when transferring from another password manager app that supports Android's built-in credential transfer feature. This makes switching to Keeper faster and easier, since you no longer have to re-enter your saved logins by hand.

AN-9216: Implements the ability to switch accounts right from the Autofill window, without leaving the app you're filling in. Just tap the avatar icon, the same as in the main app and you’ll be presented with your account options. If account switching is restricted by your organization, you'll see a clear message along with the option to log out.

AN-8862: Payment cards, addresses, and phone numbers you save in your vault now use a newer, more flexible record format. Allowing for improvements when autofilling this important information.

AN-7840: The password strength meter shown when you create, edit, or view a record now uses a smarter scoring method that better reflects how easily a password could actually be guessed or cracked, rather than just counting character types. This gives you a more accurate picture of how strong your passwords really are.

AN-9327: The updated password strength meter also checks whether your password contains information already stored in that record, such as the title, website, username, or email address. If it does, your strength score is lowered, since reusing details like your account name or site name makes a password easier to guess.

AN-8111: Your Master Password strength meter now uses the same smarter scoring method used for record passwords, giving you a more accurate strength rating as you type. If your account administrator requires a minimum password strength, you'll see that requirement clearly.

AN-9179: A new setting lets you enable stricter validation when creating or using passkeys. Turning it on adds an extra layer of assurance that your passkeys meet a higher security bar.

AN-9328: To better protect your privacy, sharing screens now use your device's built-in contact picker instead of requesting ongoing access to your full contacts list. When adding people to a shared folder or record, you'll see a picker you can use to choose contacts on demand.

AN-9426: You can now move folders and records to a different location within your shared folder structure in the latest Nested Shared Folders update. This makes it easier to reorganize your vault as your sharing needs change.

Bugs

AN-8881: Addressed issues with privileged access records appearing incorrectly in Deleted Items.

AN-9436: Corrected an issue that allowed a privileged access record to be duplicated into a new record when you shouldn't have had permission to do so.

AN-9187: Fixed an issue where creating a passkey for Keeper from within WhatsApp did not work.

AN-9247: Addressed an Autofill compatibility issue affecting certain versions of the Brave browser.

AN-9278: Resolved an issue where Autofill incorrectly offered suggestions from the Samsung Contacts app, reducing unwanted or incorrect Autofill prompts.

AN-8938: Fixed an issue where Autofill prompted you to save a one-time Duo authentication code as if it were a password.

AN-9388: Corrected an issue on Samsung Browser where Autofill would activate but not actually fill in your saved information.

AN-9090: Addressed an issue where fields labeled "email or mobile number" did not trigger Autofill suggestions.

AN-9443: Fixed a crash that could occur on Xiaomi devices immediately after logging in through Autofill.

AN-9184: Addressed issues with how master password expiration was handled after upgrading the app.

AN-9292: Fixed an issue where the Reset Master Password screen did not limit the number of incorrect password attempts, and added clear messaging if you're temporarily blocked after too many failed tries.

AN-9072: Resolved a crash that could occur when rotating your screen during a password import and then returning to Keeper.

AN-9259: Fixed a crash that occurred when tapping the two-factor authentication screen while offline.

AN-7765: Corrected issues with how the duration of a two-factor authentication requirement was calculated and enforced.

AN-9321: Addressed an issue where canceling the authentication prompt on a one-time share link prevented the prompt from reappearing.

AN-9155: Resolved an issue where entering an incorrect password during password reset showed the wrong dialog message.

AN-8696: Resolved an issue where shared results and unrecognized results could overlap on the sharing screen.

AN-8945: Fixed an issue where the clear (X) button on the Full Name field in identity and payment records did not work correctly.

AN-8996: Addressed an issue where pinching to zoom in on a password caused bottom sheets to overlap on screen.

AN-8866: Corrected an issue where numbers in the numbered list view appeared inaccurate after opening and closing a record's detail view.

AN-8972: Fixed an issue where the empty vault screen was cut off on small screens.

AN-9250: Resolved an issue where the list of actions in the record history info panel was cut off.

AN-9234: Addressed an issue where too many automatic save attempts on required fields could cause the field to lose focus and prevent typing.

AN-9223: Fixed an issue where the "Add Files" shortcut let you bypass your organization's record creation restrictions.

AN-9390: Corrected an issue where you could duplicate a record in a shared folder even without permission to manage records in that folder.

AN-9492: Resolved an issue that prevented some deleted records inside shared folders from being restored from Deleted Items.

AN-9386: Fixed an issue where records shared directly with you inside a shared folder did not automatically appear for you.

AN-9314: Addressed a data handling issue affecting how record revisions are tracked internally.

AN-9158: Corrected an issue where date fields were not masked as expected when your organization had masking enforcement turned on.

AN-9093: Fixed a dropdown display issue on the Family Plan invite screen.

AN-9224: Resolved an issue that showed an incorrect number of available slots when inviting someone to your Family Plan.

AN-9337: Addressed an issue on the Family Plan Manage Users screen where sharing suggestions appeared unexpectedly and could cause the screen to become unresponsive.

AN-9142: Fixed an issue where accepting an account transfer request did not add the account to Keeper as expected.

AN-8708: Corrected a brief flash of the vault screen that occurred when switching between the login and create account flows.

Original source

Keeper Browser Extension version 18.2.0 introduces a Hide Keeper feature which allows you to pause Keeper for a specific site or domain, an opt-in approach to a redesigned autofill prompt and an AI-Powered Phishing Protection. This release also includes onboarding reminders for new Enterprise users and various bug fixes.

Hide Keeper

Sometimes you don't want the Keeper Browser Extension to autofill or show suggestions on a particular website — for example, when you're filling out a long form manually or browsing a site where autofill gets in the way. This feature allows you to effectively have a pause-for-a-visit / site-pause to temporarily silence the Keeper Browser Extension on any domain with a single click.

What it Does

• Hides all Keeper Browser Extension autofill popups, autofill suggestions, and KeeperLock icons on the paused site
• Keeps the extension toolbar icon active so you can still open your vault or resume at any time
• Works on sites already saved in your vault and sites you haven't saved yet

Hiding Keeper on a site applies to the entire domain (e.g., all pages on example.com), not just the current URL. Your hide/restore preferences are remembered locally in your browser until you change them.

How it Works

Click the Keeper lock icon and from the overflow menu (three vertical dots), select Hide Keeper on This Site.

Alternatively, right-click on any autofill field and select Hide Keeper on this Site from the Keeper context menu.

How to Restore Keeper

If you would like to resume Keeper's functionality on a site, click the Restore button at the top of the extension toolbar. Alternatively, within the extension Settings menu, select Hidden Sites > Restore next to the site's domain name. Keeper's autofill and suggestions functionally for that site will immediately return to normal.

AI-Powered Phishing Protection (Opt-In)

Keeper's AI-powered Phishing Protection uses a zero-knowledge local AI engine to protect you against potential phishing sites. If you encounter a suspicious site, you can block it. You retain full control of your blocked sites list and can restore access at any time. Keeper's Phishing Protection is entirely optional and disabled by default.

How to Enable & Manage Phishing Protection

Enable Phishing Protection from Settings > Blocked Sites and toggle "Phishing Protection" on. Here you can also view and add sites where Keeper autofill is disabled or restore previously blocked sites.

How it Works

When a suspicious website is detected, Keeper notifies you that the site may be trying to steal your credentials. You can view details about what Keeper detected, disable Keeper on that site, or dismiss the warning. If you dismiss it, Keeper won't alert you about that site again.

Detected patterns commonly associated with fake sites designed to steal your information:

• Suspicious IP address
• Login details hidden in URL
• Look-alike characters in domain
• Brand name on unofficial domain
• Password requested by site
• Unusual link structure

Autofill Prompt Redesign (Opt-In)

The Keeper Browser Extension has been updated to make autofilling credentials faster and more intuitive, with smarter suggestions appearing inline as you interact with forms and greater control over how your saved information is applied.

Our new UI also includes a change in the detection model from 'page-level' to 'field-level'. To make the introduction gradual, we have provided an opt-in option, as we continue to refine field-level detection for even greater accuracy. By default, you'll still have the traditional UI and logic.

To turn on the new UI and logic, go to Settings > KeeperFill Tool and toggle "Enable New Autofill Prompt" on.

What's New

Inline Autofill Recommendations

The Keeper Browser Extension now displays autofill suggestions directly beneath form fields as you interact with them — no more hunting through pop-ups or menus. When you click into or tab to a login, address, or payment field, Keeper shows matching credentials from your vault in a compact list positioned just below the field. Click any item to autofill the entire form instantly.

Smart Search as You Type

Start typing in a field and the suggestions list narrows in real-time, filtering your vault entries to match what you're entering.

Multiple Credential Visibility

If you have more than one login saved for a site, all matching entries appear in a scrollable list sorted by favorites first, then recently used, then alphabetical. Use the inline search to find the right one quickly.

Granular Control of Autofill

Click the expand arrow on any suggestion to see all fields in that record. From there you can:

• Autofill only specific fields
• Copy individual values (username, password, etc.) to your clipboard using the copy icon

New User Setup Reminders

Enterprise users now receive a prompt during sign-in to websites reminding them to activate Keeper and complete setup using their company email address.

Improvements

• BE-8018: Clipboard Settings — Add "Expire Immediately" option to reflect Admin Console Clipboard Expiration enforcement policy. This setting will effectively prevent your data from entering the clipboard at all (you can still use the autofill feature to manually or automatically autofill).

Bug Fixes

• BE-7855: Record disappears from autofill and extension after account switch
• BE-7852: Incorrect matching credit cards/addresses after re-logins in new form filler
• BE-7799: Incorrect Create New Record prompt
• BE-7794: Multiple confirmation modals appear when filling payment card and address records via new form-fill prompt redesign
• BE-7733: Shared folder is not removed from vault after owner deletion when no other folders exist
• BE-7711: Address, payment card, and secure note records not displaying as expected in landscape mode
• BE-7660: SSO Connect Duo 2FA method buttons gray out after selection
• BE-7576: Select Folder Location resets after clicking away from toolbar window
• BE-7565: "Report Issue" text for Snapshot Preview Page design issue
• BE-7344: Password generator history navigation with tab key stuck on eye icon
• BE-7340: Accessibility tab does not function as expected in default password manager flow
• BE-7264: Recent sort fails to update after viewing record in toolbar window
• BE-7955: Addressed security finding related to cross-origin navigation during checkout flows (payment and address records) while confirmation dialog is in a pending state
• BE-7956: During HTTP Basic Auth autofill scenarios, only offer credentials that match the origin of the request (e.g. http:// authorization only offered if the record URL uses http:// as opposed to https://)

Original source

Gateway 1.8.9 enhances the CNAPP/Wiz Remove Standing Privilege flow and fixes an Active Directory password rotation failure.

Improvements

DR-1328: Improve the CNAPP "Remove Standing Privilege" remediation action by prefilling a user's current group and role names, allowing all or selected groups and roles to be removed without manual entry

Bugs

PG-447: Issue where AD password rotation fails while resolving the Active Directory domain

Please visit the Keeper Gateway documentation for your specific platform:

Original source

Forcefield 1.2.1 strengthens protection against code injection, tampering, and driver vulnerabilities. It also improves installer feedback and ensures the service starts correctly after SYSTEM-context deployments.

Changes

FF-19: Installer fails explicitly with an error message instead of failing silently on incompatible host architecture

FF-22: Resolves issue with SYSTEM-context deployments (e.g., Intune) so Forcefield service properly auto-starts on login after reboot

FF-25: Fixes denial-of-service / buffer overflow vulnerability in keeperforcefield.sys during Authenticode hash calculation

FF-26: Fixes vulnerability allowing bypass of Forcefield protections via thread manipulation

FF-27: Adds keeperdb-desktop.exe (KeeperDB) to the driver's list of protected processes

FF-28: Resolves bypass vulnerability involving DLL injection into trusted sihost.exe process

FF-29: Adds keeperforcefield.exe to driver protected process list for self-protection against tampering

FF-30: Updates handle stripping to remove PROCESS_VM_WRITE and PROCESS_VM_OPERATION to prevent code injection

FF-31: Corrects driver process name from keeper-gateway-service.exe to keeper-gateway.exe

VM-1367: Bugcrowd vulnerability report for keeperforcefield.sys kernel pool buffer overflow

Original source