> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/release-notes/enterprise/keeper-connection-manager/kcm-version-2.26.0.md).

# KCM Version 2.26.0

Released on Oct 7, 2026

This release adds Kerberos authentication for Active Directory Protected Users. It also hardens database and browser-isolation sessions, updates core dependencies, and fixes the Connection Import layout.

### New features and improvements

* **KCM-281: Kerberos Authentication for Active Directory "Protected Users"** 
  * Added Kerberos authentication support for RDP sessions via FreeRDP, enabling accounts in Active Directory's high-security **Protected Users** group to authenticate.
  * Configured containerized `guacd` to maintain Kerberos ticket caches in memory per connection process (`KRB5CCNAME=MEMORY:`), ensuring credentials are not shared and avoiding Linux kernel keyring restrictions in container environments.
* **KCM-614: Chromium / CEF Upgrade for Remote Browser Isolation (RBI)**
  * Upgraded `kcm-libcef` to Chromium Embedded Framework (CEF) 152 to maintain compatibility with modern web standards, improved stability, and file upload/download flows within isolated browser sessions.

### Security fixes

* **KCM-612: Restriction of PSQL Arbitrary Reconnection and Credential Forwarding**
  * Removed support for the PostgreSQL `\c` (connect) command in interactive database sessions to prevent users from redirecting connections or inadvertently exposing connection credentials to unauthorized external destinations.
* **KCM-609: Hardened Database-Type Connection Shell Execution**
  * Disabled `vi-histedit` and Emacs runtime command rebinding (`ed-command` / `Meta-x`) within `libedit` during database connection sessions. This mitigates risks of external process or shell invocation (such as executing commands from `~/.exrc`) under the `guacd` user context.
* **KCM-610: WebAuthn Origin Validation in RBI**
  * Resolved an issue in Remote Browser Isolation where origin verification for WebAuthn authentication was not properly enforced.
* **KCM-620: Security Patching for** `libssh2`
  * Backported and applied security patches for critical and high-severity CVEs affecting `libssh2` used in SSH and SFTP connections.
* **KCM-613: Third-Party Dependency Vulnerability Remediation** 
  * Updated key system packages and dependencies (including `FreeRDP` and `libvncclient`) to their latest secure compatible releases to resolve known CVEs and maintain a clean SBOM.

### Bug fixes

* **KCM-589: Connection Import Dialog Layout Fix**
  * Fixed an issue where the license expiration notification banner displaced action buttons on the Connection Import screen. The banner now overlays cleanly, can be dismissed, and does not interfere with the **Cancel** or **Import Connections** buttons.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/release-notes/enterprise/keeper-connection-manager/kcm-version-2.26.0.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.