KeePassXC released version 2.8.0 on October 21, 2026, as the first stable release in its 2.8 series. The update moves the app from Qt 5 to Qt 6, adds Auto-Type on Wayland for Linux, and includes five vulnerability fixes that KeePassXC says affect all 2.7.x versions and earlier.
Wayland Auto-Type is a Linux feature
KeePassXC 2.8.0 uses XDG Desktop Portals for Auto-Type on Linux systems running Wayland. Auto-Type enters saved credentials into application fields; the new Wayland support gives Linux users that option in this display environment.
The Qt 6 migration applies to KeePassXC as a whole. It is separate from the Wayland-specific Auto-Type change.
Quick Unlock and ARM builds vary by platform
On Linux, Quick Unlock uses Polkit. On its first launch, this feature adds a UUID to the database’s public metadata and marks the database as modified. That can explain a modified indicator when Linux users first open a database with this Quick Unlock option.
On macOS, KeePassXC can use the device password for Quick Unlock when Touch ID is unavailable. Windows has native ARM64 builds, while Linux has an experimental AArch64 AppImage.
What KeePassXC says the five fixes address
KeePassXC says all versions in the 2.7.x series and earlier are affected by the five vulnerabilities. The project rates their severity from low to moderate and says they do not affect KeePassXC’s core functionality or cryptography.
The five fixes address:
- A use-after-free when importing crafted KDB files, listed as CVE-2026-69150.
- Entry-reference injection when creating or updating entries through the browser extension.
- Out-of-bounds writes while encrypting and decrypting native-messaging messages.
- Shared-memory mapping names used when sending SSH keys to Pageant.
- An integer overflow and out-of-bounds read in the legacy KDB importer.
The announcement assigns a CVE identifier to the first fix and marks the other four CVE-PENDING. KeePassXC recommends updating to 2.8.0.
The release notes list three other security-related changes separately: Secret Service listings exclude protected attributes, Windows corrects a clipboard-exclusion format name, and KeePassXC improves clearing decrypted database fragments handled by zlib.
Remote database tools and SSH keys
KeePassXC 2.8.0 supports remote database synchronization and import using external tools. The release also adds SSH Agent key generation for RSA, ECDSA, and Ed25519 keys, configurable keyboard shortcuts, and Windows Group Policy overrides.
KeePassXC directs users to its official download page.
