Keeper-Security/Commander v18.1.9

Release 18.1.9

on GitHub

Security

• The ldap3 library disables TLS certificate validation when created with default parameters, so an attacker on the network could impersonate an Active Directory server over LDAPS and capture bind credentials or feed forged directory data to pedm scim and SCIM sync. Certificates are now validated by default; --ad-ca-cert trusts a custom CA and --insecure explicitly opts out.
• Service Mode filesystem bypasses: Closed bypasses in Service Mode command verification that let a request reach filesystem operations the service is meant to restrict, allowing reads or writes outside the permitted scope.
• download-attachment path traversal: A shared folder with an attacker-chosen name (e.g. containing ..) could make download-attachment write files outside the chosen output directory. Resolved paths are now checked to stay within the output directory.

Features

• Notification Center: New notification command (list, view, read, unread, approve, deny). Handles device approvals, share requests and PAM workflow access requests; data is processed from sync-down.
• Tailscale Funnel: Tailscale Funnel is a new Service Mode tunnel option alongside ngrok and Cloudflare, including a Docker sidecar setup, Windows installation and advertise tags.
• Self-managed Keeper deployments: Commander now uses the server key of a self-managed deployment instead of Keeper's built-in key 7, which previously caused every request to fail with key_id -1. The key can be set with server <host> --key-id --public-key, KEEPER_SERVER_PUBLIC_KEY/KEEPER_SERVER_PUBLIC_KEY_ID, or fetched (fingerprint-verified, HTTPS only) from the deployment; server <host> --insecure skips the certificate check for that host.
• Biometric login: Added roaming FIDO2 passkey support.
• USS: Dry-run support for USS syncs, showing parsed results before the actual sync is confirmed; new objectStorageBucket USS config setting.
• pam rbi edit gains --allow-supply-user and --clipboard-buffer-size.
• drive_redirection_path is now supported in PAM import RDP settings.
• import/export: New --keepass-password and --keepass-key-file options for KeePass import, and password/key file arguments for import and export (none omits them).
• CyberArk PAM import can now create users.
• download membership gains timeout and API page-size limit arguments.
• pam action saas config --list/--info supports --format json.

Improvements

• Generated and manually entered passwords and passphrases are validated against domain-specific policies selected by record URL, across record add/edit, including v3 and NSF records and Unicode passphrases.
• pam project extend derives resources/users folders and adds folder options.
• pam project extend uses set_launch_credentials for existing resources and re-asserts the admin credential when no launch credentials are set; corrected --keeper-proxy help text (SSH is supported).
• pam project export returns parsed JSON in Service Mode.
• Reporting permission failures are surfaced early and clearly.
• Invalid KEEPER_RATE_LIMIT values now produce clear errors, and rate limiting no longer fails silently in Service Mode.
• nsf-mkdir/nsf-rmdir/nsf-rndir return correct Service Mode HTTP status and message field.
• Clearer wording for accept-transfer results, and a corrected denial message for the deny-workflow encryption change.
• Added a KeeperAI-closed banner to pam tunnel start.

Fixes

• accept-transfer always failed because of an incorrect check on the API result.
• Fixed incomplete NSF folder access rows (batch size 100 → 20) and denied access entries displaying as grants in tree -v, nsf-get and share reports.
• Fixed AttributeErrors that masked real failures in record-add and ls.
• Fixed checkOutBy not populating in single-user check-out mode.
• Fixed KEPM delete policy accepting unresolved UIDs.
• Fixed ECDSA key registration in the Commander SSH agent (removed cryptography API and missing RFC 5656 curve name).
• Audit-log syslog now emits the RFC 5424 NILVALUE for an empty or invalid HOSTNAME.

Full commit range: v18.1.8..v18.1.9