> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/release-notes/enterprise/keeper-secrets-manager/2026/secrets-manager-cli-1.5.0.md). # Secrets Manager CLI 1.5.0 ### Security * **KSM-1168:** Fixed an authorization gap in `ksm sync --type aws` where a Keeper user with add access to a synced folder could craft a record title to target arbitrary secrets in the operator's AWS account. Secret names written to AWS are now confined to a caller-supplied namespace prefix (`--prefix`). Dry-run output no longer includes the live destination secret value for any cloud backend (AWS, Azure, GCP). ### Improvements * **KSM-1114:** Removed the unmaintained `colorama` dependency; terminal coloring now uses `click.style()`, already present via `click-help-colors`, with no new dependency added * When `KSM_CONFIG` is set and a keyring profile would otherwise take precedence, the CLI now warns on stderr naming the active config source. The warning is suppressed when the keyring is unavailable or empty, so CI and container environments using `KSM_CONFIG` exclusively see no output. ### Bug Fixes * **KSM-929:** Fixed locked OS keyring (e.g. gnome-keyring over SSH) silently returning no profiles; CLI now raises an actionable error pointing at `--ini-file` / `KSM_CONFIG` as a fallback * **KSM-1113:** Fixed config path search on Windows (`%APPDIR%` → `%APPDATA%`) and on Linux (`/etc` entries now resolve as absolute paths instead of relative to the current directory) * **KSM-1107:** `ksm secret add clone` now exits non-zero when the source UID does not exist, instead of silently exiting 0 * **KSM-1118:** Fixed `ksm secret add clone` crashing with "list index out of range" when the source record contained an unpopulated complex field (name, address, host, etc.) * **KSM-1126:** Fixed `ksm secret add file` and `ksm secret add editor` crashing with the same "list index out of range" error when the record contained an unpopulated complex field * **KSM-1135:** Fixed `ksm secret download` crashing with `MissingSchema: Invalid URL 'None'` when called immediately after `ksm secret upload`; the vault propagates the file's download URL asynchronously and the CLI now raises a clear retry message * **KSM-1155:** Fixed fatal keyring storage errors swallowing the underlying error message; the original error is now surfaced directly * **KSM-1156:** Fixed `ksm shell` crashing at startup with `UnicodeEncodeError` when stdout could not represent the Unicode box-drawing banner (cp1252 on piped/redirected Windows output, C-locale pipes on Linux); the shell now falls back to a plain-text banner * **KSM-1157:** Fixed `ksm shell` ignoring session global options (`--ini-file`, `--profile-name`, `--output`, `--color`, `--cache`, `--log-level`) for commands run inside the shell; all session options now propagate to inner commands * **KSM-1162:** Fixed `ksm shell` on Windows corrupting file paths containing backslashes; `C:\dir\file.ini` was silently converted to `C:dirfile.ini` * **KSM-1165:** Fixed `ksm shell` truncating command arguments at `#` characters; UIDs and paths containing `#` are now passed through intact * **KSM-1163:** Fixed two `keeper.ini` discovery bugs on all platforms: `KSM_INI_DIR` was silently overridden by a `keeper.ini` in the current directory without any warning, and unset environment variables in the search path were probed as literal directory names * **KSM-1018:** Fixed macOS installer crashing on every `ksm` invocation; bundled libssl updated to OpenSSL >=3.2.0 (x64 and arm64) * **KSM-1105:** Fixed Windows installer's post-install launch of `ksm.exe` being blocked by endpoint security (EDR/AV) * **KSM-1106:** Fixed macOS PKG installer ignoring Keyring and Cloud Sync component checkboxes in GUI mode; the installer now respects the user's component selection * **KSM-1116:** Fixed Windows installer placing the 64-bit binary in `Program Files (x86)` instead of `Program Files` on 64-bit systems * **KSM-1159:** Fixed Windows installer appending a duplicate PATH entry on every install or upgrade * **KSM-1164:** Fixed Windows uninstall and upgrade corrupting the system PATH by writing it as `REG_SZ` instead of `REG_EXPAND_SZ`; `%SystemRoot%` and `%WINDIR%` expansion was broken in all subsequent processes after the uninstaller ran * **KSM-1117:** Fixed the Docker Alpine image shipping a musl 1.2.4 base image while the bundled binary required musl >= 1.2.5; the `/cli/musl/ksm` init-container binary failed to load in its own image * **KSM-1120:** Fixed the Docker `/cli/glibc/ksm` and `/cli/musl/ksm` init-container binaries shipping as amd64 ELF on all platforms; arm64 init-containers have never had a functional binary * **KSM-1160:** Fixed `install.sh` producing a cryptic PyInstaller crash on Alpine 3.19 (musl 1.2.4) or systems with glibc < 2.28; the script now checks platform compatibility before installing * **KSM-1169:** `ksm sync` dry-run output no longer includes the live destination value for Azure Key Vault or GCP Secret Manager; behavior now matches AWS. Destination names supplied via `--map` are validated against Azure and GCP naming rules before any write is attempted. * **KSM-1170:** `ksm sync --record` and `--folder` now warn on stderr when a token resolves by record title or folder name rather than by UID, since those identifiers are mutable. Resolution behavior is unchanged; UIDs are recommended for scheduled syncs. * **KSM-1171:** `ksm init k8s` now uses a YAML serializer to build the Kubernetes Secret manifest, so `--name` and `--namespace` values are always properly encoded and cannot inject content into the manifest. ### Breaking Changes * **KSM-1168:** `ksm sync --type aws` with `--record`, `--folder`, or `--folder-recursive` now requires a `--prefix` argument. Existing sync commands must add `--prefix ` (e.g. `--prefix keeper/`). * **KSM-1120:** Linux GitHub release tarballs now include the architecture in the filename. The previous single Linux tarball is replaced by `keeper-secrets-manager-cli-linux-amd64-1.5.0.tar.gz` and `keeper-secrets-manager-cli-linux-arm64-1.5.0.tar.gz`; the Alpine tarball is split the same way, into `keeper-secrets-manager-cli-alpine-linux-amd64-1.5.0.tar.gz` and `keeper-secrets-manager-cli-alpine-linux-arm64-1.5.0.tar.gz`. Scripts that reference the old unsuffixed tarball names need to be updated. ### Resources * [PyPI Package](https://pypi.org/project/keeper-secrets-manager-cli/1.5.0/) * [Docker Hub](https://hub.docker.com/r/keeper/keeper-secrets-manager-cli/tags?name=1.5.0.1) * [GitHub Releases](https://github.com/Keeper-Security/secrets-manager/releases/tag/ksm-cli-1.5.0) * [CLI Documentation](https://docs.keeper.io/en/keeperpam/secrets-manager/secrets-manager-command-line-interface) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.keeper.io/release-notes/enterprise/keeper-secrets-manager/2026/secrets-manager-cli-1.5.0.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.