KeePassXC 2.8.0 adds Wayland Auto-Type, Qt 6 migration, multiple security fixes

Brief written by the FOSSWire AI editor from KeePassXC How we write

October 21, 2026 1 min read

Key Takeaway

KeePassXC 2.8.0 migrates to Qt 6, adds Wayland Auto-Type via XDG Desktop Portals, and patches five CVEs including a use-after-free in KDB import.

Summary

KeePassXC 2.8.0 is a major release of the open-source password manager. The project completes its migration from Qt 5 to Qt 6, adds native Wayland Auto-Type support for Linux users through XDG Desktop Portals, and introduces Quick Unlock via Polkit on Linux and device password fallback on macOS. The release also includes native Windows Arm64 builds, configurable keyboard shortcuts, and remote database synchronization via external tools. Five security vulnerabilities are patched, including CVE-2026-69150 for a use-after-free in crafted KDB file import and multiple browser integration flaws.

What's new in KeePassXC 2.8.0

Qt 6 migration: Complete port from Qt 5, affecting build system and all platform code paths
Wayland Auto-Type: Uses XDG Desktop Portals instead of X11-specific APIs, enabling Auto-Type on compositors that implement the portal
Linux Quick Unlock via Polkit: System authentication integration; note that first launch modifies database metadata by adding a UUID to public headers
SSH Agent key generation: Can now generate RSA, ECDSA, and Ed25519 keys directly without external tools
Security fixes: CVE-2026-69150 (KDB import use-after-free), two browser extension CVEs pending assignment (entry reference injection, out-of-bounds native messaging), two additional pending CVEs from NATO NCSC (Windows SSH Pageant memory randomization, KDB importer integer overflow)
Build simplification: New KPXC_MINIMAL CMake option bundles feature flags
Linux packaging: AArch64 AppImage added, application state moved from XDG_CACHE_HOME to XDG_STATE_HOME per XDG spec

Why it matters

The Qt 6 migration positions KeePassXC for modern Linux desktop lifecycle, while Wayland Auto-Type via portals removes a long-standing blocker for users on non-X11 compositors. The five security fixes, including one credited to NATO's cyber security center, warrant prompt upgrade for all users especially those using browser integration or KDB legacy import.

What to do

Update to KeePassXC 2.8.0 to receive security fixes for five CVEs including CVE-2026-69150.
Linux users on Wayland can now use Auto-Type through XDG Desktop Portals after updating.
If you build from source, note the migration to Qt 6 and the new KPXC_MINIMAL CMake option.

Original reference: github.com →