KeePassXC 2.8 finally ships native Wayland Auto-Type and moves to Qt 6

October 21, 2026. KeePassXC ships stable version 2.8.0, the first of the 2.8 series, one month after the beta. October 21, 2026. The most-requested feature in years finally lands: native Wayland Auto-Type, delivered through XDG Desktop Portals. October 21, 2026, the same day. The release notes fix five security flaws, every one of them in the manager’s “bridges” — importers, the browser extension, the SSH agent — and none in the vault’s cryptography. For anyone who types passwords on a Wayland desktop or imports old KDB databases, this release is not cosmetic.

Native Wayland Auto-Type closes the long-standing gap

Auto-Type is the feature that simulates keystrokes to fill in a login form. Under X11 it worked by injecting keys through the X protocol — a mechanism Wayland deliberately removed on security grounds: no client may synthesize global keyboard input anymore. As a result, KeePassXC’s Auto-Type was broken on pure Wayland sessions and only survived through partial workarounds using XWayland. By community consensus, it was the project’s number-one gap.

Version 2.8.0 closes it through the official route: Auto-Type now goes through XDG Desktop Portals, the interface that lets an application ask the compositor to inject input on its behalf. In practice the manager no longer touches the keyboard itself — it delegates injection to the display server, which keeps control. This requires a compositor that implements the right portal, which is the case for GNOME, KDE Plasma, and wlroots-based environments through xdg-desktop-portal.

The stakes are not trivial. Wayland is now the default session on the major distributions — Fedora and Ubuntu first among them — and KDE Plasma has formally relegated X11 to second place. A password manager whose flagship feature does not work on the default desktop loses most of its appeal against the password managers built into browsers. KeePassXC 2.8.0 restores parity at the right moment.

Qt 6 and ARM64: a modernized base rather than a patch release

The Qt 5 to Qt 6 migration is the release’s other major project. Qt 5 is reaching end of commercial life and its security fixes are thinning out; staying on it would expose the project to mid-term maintenance problems. Moving to Qt 6 unlocks proper HiDPI handling, better Wayland integration, and support for modern platforms along the way.

Version 2.8.0 is also the first to ship native ARM64 builds for Windows and an experimental AArch64 AppImage for Linux. The signal is clear: the ARM fleet — Snapdragon X on Windows, Apple Silicon on macOS, ARM64 boards on the server side — is no longer a niche. A password manager has to follow the machines its users actually work on.

The remaining additions round out the base: configurable keyboard shortcuts, remote database synchronization through external tools, quick unlock via Polkit on Linux (and by password on macOS), and RSA, ECDSA, and Ed25519 key generation in the SSH agent. None of these is spectacular on its own; together they remove the everyday friction that was pushing some users toward proprietary alternatives.

Five security fixes, all in the bridges, none in the vault

The security note is instructive for anyone tracking a password manager’s attack surface. The five flaws affect all 2.7.x versions and earlier, are rated low to moderate, and none touches the cryptographic core — the AES encryption, Argon2 key derivation, or the KDBX format remain intact. They sit in the bridges: the file importers and the browser-extension channel.

Two fixes concern KDB import. CVE-2026-69150 is a use-after-free when importing a crafted KDB file; a second fixes an integer overflow and an out-of-bounds read in the legacy KDB importer. These two matter for teams that recover archives or databases pulled from compromised machines: a malicious KDB file should never be able to make the manager executing code on open.

Two further fixes hit the browser channel: an entry-reference injection when creating or updating entries through the extension, and out-of-bounds writes when encrypting and decrypting native messaging messages. The fifth concerns Windows: the shared-memory mapping names used to pass SSH keys to Pageant are now randomized.

Three details are worth noting. NATO’s NCSC — through Viktor Markopoulos of NCIA/NCSC — is credited for two of the flaws, a sign that password managers have entered the scope of national defense teams. GitHub has still not assigned CVE identifiers to four of the five flaws more than a month after the request, a delay that complicates automated patch tracking. Finally, the project states that none of the flaws was introduced by AI-generated code, but that AI helped find them — a useful data point in the debate over automating vulnerability research.

Verdict

If you use Auto-Type on a Wayland desktop, install KeePassXC 2.8.0 now: it is the first version where the feature works natively, and there is no longer any reason to stay on 2.7.x. If you import KDB or KDBX files of uncertain origin — post-incident recovery, a colleague’s archive, shared repositories — the upgrade is equally urgent, since two of the five fixes target the importers themselves. For everyone else, the Qt 6 migration and the security fixes make this a recommended, low-risk update: the database format is stable, and 2.8.0 opens your existing vaults without conversion. The lesson that goes beyond KeePassXC is that a password manager’s security now lives as much in its bridges — browser, importers, SSH agent — as in the vault itself.

Références

• KeePassXC — KeePassXC 2.8.0 (Stable) released (October 21, 2026)
• KeePassXC — Security advisory GHSA-4642-49vv-4p43 (CVE-2026-69150)
• 9to5Linux — KeePassXC 2.8 Released with ARM64 and Wayland Auto-Type Support on Linux (October 22, 2026)
• Linuxiac — KeePassXC 2.8 Password Manager Released with Qt 6, Wayland Support (October 22, 2026)