> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/release-notes/desktop/web-vault-+-desktop-app/vault-release-18.6.6.md). # Vault Release 18.6.6 Released on October 29, 2026 ## Overview Web Vault & Desktop App version 18.6.6 introduces keyboard shortcuts for faster record navigation, an improved "Launch As" credential selector that surfaces recently used and favorited credentials first, and GitHub Actions as a new Universal Secret Sync target. Users can now set a max distance security policy called "Impossible Travel" for location-based access control, PAM users can now view linked resources directly from the PAM User screen, and Danish language support has been added across both clients. This release also includes the Electron framework upgrade to 43.7.5, Nested Shared Folders stability improvements, and a broad round of bug fixes across Discovery, KeeperDrive, CNAPP, PAM workflows, and SSO Connect. ## New Features ### Impossible Travel Setting Impossible Travel now applies a distance limit to Keeper’s Stay Logged In feature. When you reopen Keeper after closing your browser or restarting your computer, Keeper calculates the distance from your current location to where your session was last active. If that distance is greater than the limit you set, you will be required to log in again. This helps protect against reuse of stolen or long-lived sessions, with no change for sign-ins from familiar locations. #### How it Works To set a distance limit, go to **Settings > Security** and enable "Stay Logged In". Under "Impossible Travel", enter a number, choose miles (mi) or kilometers (km) and select **Update**.

Impossible Travel Settings

### **Ephemeral Accounts for Just-in-Time Access in Keeper Privileged Cloud** Ephemeral accounts strengthen security when accessing your target systems. Instead of connecting with long-lived credentials stored in your vault, Keeper creates a temporary user account in the target cloud or directory provider. Supported providers includes: * AWS * Okta * GCP * Active Directory When the approved duration expires, that account is removed, so there is no standing account for anyone to reuse. Ephemeral account creation is part of [**Keeper Privileged Cloud**](/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud.md), which extends KeeperPAM’s Just-In-Time (JIT) access to cloud and directory platforms. #### How it Works Ephemeral accounts reduce risk in three ways: * Standing credentials are no longer exposed to users or stored where they could be copied or reused. * Each connection gets its own account, which makes activity easier to trace back to a specific session. * There are fewer accounts to rotate, monitor, and retire. This supports a zero standing privilege model. To enable this setting, navigate to the resource's **PAM Settings** and under the "JIT" tab check the box for **Create ephemeral account for connection**. Once enabled, users connect to the target account using temporary account, with no stored password to manage.

Activated Ephemeral Account Creation

{% hint style="info" %} ## **To learn more about Ephemeral Accounts for Just-in-Time Access click** [**here**](/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud.md)**.** {% endhint %} ## Improvements * **VAUL-9293:** GitHub Actions is now available as a sync target for Universal Secrets Sync. * **VAUL-9226 & KDE-2181:** Added Danish as a supported language. * **VAUL-9700 & KDE-2320:** Updated Web vault dependencies for 18.6.6. * **VAUL-9566 & KDE-2303:** Updated Web vault dependencies for 18.6.5. * **VAUL-9446:** Removed the NSF compatibility banner. * **VAUL-9393:** Moved Universal Secrets Sync configuration to the Features tab. * **VAUL-9300:** Fixed how BreachWatch numbers are displayed. * **VAUL-9286:** The Launch As credential selector now lists Recently Used first, then Favorites, then All Credentials. * **VAUL-9206:** Added keyboard shortcuts to the record detail view. * **VAUL-9161:** Users get an option to reload when the app cache is updated. * **VAUL-8510 & KDE-2276:** Added the Max Distance security policy. * **VAUL-7319:** The PAM User screen now shows linked resources. * **VAUL-9568:** Optimized vault builds. * **VAUL-9503:** Added AU to the region selector in Dev/QA. * **VAUL-9413:** Copying a hidden field now logs a copied\_hidden\_field audit event. * **VAUL-9373:** Refactored the Checkbox component so it no longer keeps its own internal state. * **VAUL-9351:** Refactored the Discovery publishing review modal. * **VAUL-9259:** Added new translatable strings to the Discovery views. * **VAUL-9183:** Updated vault favicons. * **VAUL-8942:** Improved Universal Secrets Sync v1. * **VAUL-7611:** Added new Discovery APIs for bulk actions (set\_record\_rotation, configure\_resource). * **VAUL-7538:** PAM records can no longer be converted to non-PAM record types. * **KDE-1755:** Added keyboard shortcuts to the record detail view. * **KDE-2316:** Upgraded Electron from 42.11.6 to 43.7.5. * **KDE-2260:** Optimized Desktop builds. * **KDE-2258:** Copying a hidden field now logs a copied\_hidden\_field audit event. * **KDE-2257:** postMessage calls in preload.ts now specify an origin. * **KDE-2184:** Added a GitHub Actions check that confirms every renderer declares a Content Security Policy. * **KDE-2166:** Updated or replaced the electron-windows-store repo. * **KDE-2224:** Automated handling of single vulnerability (VM) tickets (Phase 1). * **KDE-1721:** Removed macOS Touch Bar support. ## Bug Fixes * **VAUL-9703:** Fixed the record detail panel rendering shifted left, and an invisible overlay that blocked clicks on the View Password/View Contents button. * **VAUL-9301:** Fixed JSX SVG syntax errors. * **VAUL-9553:** Fixed PAM Configuration and Keeper Resource selections staying stuck on Tenable issues during CNAPP onboarding. * **VAUL-9535:** Fixed an error when using Move To on a bulk selection in NSF. * **VAUL-9521:** Fixed connection deep links opening a [keepersecurity.com](http://keepersecurity.com/) RBI session by mistake. * **VAUL-9515:** Fixed the off-center, wobbly arrow animation on the PAM Rotate Now button. * **VAUL-9439:** Separated the KD GRE logic and added clearer messages for indirect actions in NSF. * **VAUL-9429:** KeeperJSON imports now convert $text values to strings. * **VAUL-9423:** Input passed to dangerouslySetInnerHTML is now sanitized. * **VAUL-9385:** Custom fields can now be edited in the PAM Configuration UI. * **VAUL-9369:** Fixed a vault crash in Discovery job review when every selected item is filtered out. * **VAUL-9352:** The Discovery publishing modal now checks enforcements for admin credentials. * **VAUL-9337:** Fixed titles not wrapping correctly in Secrets Manager when the screen is resized. * **VAUL-9325:** Fixed manual publishing dropping custom fields. * **VAUL-9317:** Closed a way to bypass the "Can create folders inside shared folder only" enforcement by moving folders out of Shared Folders. * **VAUL-9305:** Fixed KSM apps created with Read Only record permission getting Can Edit access in KeeperDrive. * **VAUL-9290:** Aluminum theme icons are now easier to see in dark mode. * **VAUL-9281:** Record filter bars now use the same search algorithm as vault search. * **VAUL-9277:** End users can now see which group they were elevated to. * **VAUL-9273:** Fixed inconsistent error display for the "Creating and Sharing" role enforcement. * **VAUL-9266:** Fixed Discovery publishing applying wrong admin credential settings when the user record has rotation settings. * **VAUL-9265:** Fixed a vault crash when removing the last item in the Discovery review modal. * **VAUL-9188:** Fixed the "in list" operator in Discovery Rules. * **VAUL-9158:** Fixed odd behavior when a remote user updates a Keeper record. * **VAUL-9151:** Record owners can now elevate themselves on a PAM resource record. * **VAUL-9080:** Fixed the "Cannot share or receive items" enforcement blocking users from creating folders and records in NSF. * **VAUL-9038:** Fixed translations in the dark mode settings. * **VAUL-9030:** Fixed dark mode display of KeeperDrive icons, the AWS icon and the application folder dropdown. * **VAUL-8839:** Fixed the "This object no longer exists" error when using Delete All Unshared Owned Records in KeeperDrive. * **VAUL-9437:** Security fix for vulnerability VM-2890. * **VAUL-9482:** Fixed Workflow Approvers list headings repeating for each user. * **VAUL-9479:** Help popups no longer appear behind the PAM Settings modal. * **VAUL-9424:** Fixed an empty record editor appearing when access to an application is lost during editing. * **VAUL-9336:** Fixed broken translations in Secrets Manager. * **VAUL-7962:** Fixed configure\_resource error handling so it no longer fails silently. * **KDE-2307:** Restored the missing Launch As option under Tunnels. * **KDE-2305:** Fixed the Windows preflight integrity check that failed on every 18.6.5 installation. * **KDE-2304:** Special characters are now escaped (vulnerability fix VM-2890). * **KDE-2278:** Fixed login page controls becoming unclickable after an automatic logout. * **KDE-2261:** Fixed the pinned taskbar icon breaking after upgrading the 32-bit build from 18.6.1 to 18.6.2. * **KDE-2301:** Fixed Desktop Windows CI builds hanging during npm ci. * **KDE-2197:** CryptoKey values stored in IndexedDB are now handled correctly for some users after a data migration. ## Web Vault Update Instructions * To ensure you're using the latest Web Vault, simply reload the vault login page (or Shift+Ctrl/Cmd+R to force refresh) ## Desktop Update Instructions * If you installed Keeper Desktop directly from the Keeper website, download the latest version from:\ * If you installed Keeper Desktop from the Mac App Store or Microsoft Store, visit the store to perform the update. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.keeper.io/release-notes/desktop/web-vault-+-desktop-app/vault-release-18.6.6.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.