# KeePassXC 2.8.0 adds Wayland Auto-Type, Qt 6 migration, multiple security fixes

> **Key takeaway:** KeePassXC 2.8.0 migrates to Qt 6, adds Wayland Auto-Type via XDG Desktop Portals, and patches five CVEs including a use-after-free in KDB import.

**Published:** 2026-10-21T22:00:44+00:00 
**Source:** KeePassXC Password Manager Releases 
**Category:** foss-apps 
**Canonical URL:** https://fosswire.org/news/keepassxc-280-adds-wayland-auto-type-qt-6-migration-multiple.html 

## Summary
KeePassXC 2.8.0 is a major release of the open-source password manager. The project completes its migration from Qt 5 to Qt 6, adds native Wayland Auto-Type support for Linux users through XDG Desktop Portals, and introduces Quick Unlock via Polkit on Linux and device password fallback on macOS. The release also includes native Windows Arm64 builds, configurable keyboard shortcuts, and remote database synchronization via external tools. Five security vulnerabilities are patched, including CVE-2026-69150 for a use-after-free in crafted KDB file import and multiple browser integration flaws.

## What's new in KeePassXC 2.8.0
- **Qt 6 migration**: Complete port from Qt 5, affecting build system and all platform code paths
- **Wayland Auto-Type**: Uses XDG Desktop Portals instead of X11-specific APIs, enabling Auto-Type on compositors that implement the portal
- **Linux Quick Unlock via Polkit**: System authentication integration; note that first launch modifies database metadata by adding a UUID to public headers
- **SSH Agent key generation**: Can now generate RSA, ECDSA, and Ed25519 keys directly without external tools
- **Security fixes**: CVE-2026-69150 (KDB import use-after-free), two browser extension CVEs pending assignment (entry reference injection, out-of-bounds native messaging), two additional pending CVEs from NATO NCSC (Windows SSH Pageant memory randomization, KDB importer integer overflow)
- **Build simplification**: New `KPXC_MINIMAL` CMake option bundles feature flags
- **Linux packaging**: AArch64 AppImage added, application state moved from `XDG_CACHE_HOME` to `XDG_STATE_HOME` per XDG spec

## Why it matters
The Qt 6 migration positions KeePassXC for modern Linux desktop lifecycle, while Wayland Auto-Type via portals removes a long-standing blocker for users on non-X11 compositors. The five security fixes, including one credited to NATO's cyber security center, warrant prompt upgrade for all users especially those using browser integration or KDB legacy import.