Commander 18.0.9

Released on June 23, 2026

New Features

• KeeperAI PAM Connection Settings pam connection ai

New command to manage KeeperAI settings on PAM resources and remote browser instances. Supports show, set, unset, and remove operations for AI configuration on PAM connections.

• PAM Gateway Online Filter

The command pam gateway list now accepts --online (-o) to filter results to only online gateways, along with gateway totals in the output.

• Enterprise MSP Transfer

Added support for transferring a managed company to another MSP. The backend will be live next week in production to support this command.

• Thycotic Import: Selective Secret IDs

import --format thycotic now accepts --secret-ids (comma-separated) to import or inspect specific secrets by ID — useful for debugging cases where the Thycotic lookup API omits secrets due to security policies.

• KCM: Port Mapping Defaults and Empty User Handling

KCM export now supports connections with empty user or port fields: missing ports fall back to protocol defaults (configurable via KCM_mappings.json), connections missing a user are logged for follow-up, and allow-file-uploads is available for RBI connections.

Bug Fixes

• Fixed a SQL injection vulnerability in legacy Commander MSSQL password rotation and added input validation to reject unsafe --password values.
• Fixed an issue where pam rotation edit did not correctly apply SaaS profiles.
• Fixed the permission-check rotation request for IAM user links — configurationUid, matching revision, and an explicit empty resourceUid are now sent to correctly handle IAM rotation semantics.
• NSF Share Expiration and Folder Labels
• Fixed expiration updates for nsf-share-folder and nsf-share-record
• Enforced a one-minute minimum on NSF and classic share expiration
• Standardized list/search record_category output to lowercase (classic/nested)
• Renamed Supershell Drive folder labels to Nested Shared Folder (Shared) and Nested Shared Folder (NonShared)
• Nested Shared Folder - Record Add/Update Policy Enforcement: The nsf-record-add and nsf-record-update commands now enforce GENERATED_PASSWORD_COMPLEXITY and RESTRICT_RECORD_TYPES enterprise policies.