KeePassXC 2.8: Wayland Auto-Type, database sync, Qt 6

KeePassXC 2.8.0 has been available as a stable release since 21 October 2026, after a first beta on 23 September (GitHub release, verified). For Linux admins one line in the release notes matters most: Auto-Type now works on Wayland, through the XDG Desktop Portals. The release also brings the migration to Qt 6, a remote synchronization feature and several security fixes. This post is based on the notes, the related pull request and the CVE entries.

The icon is released under CC0, the KeePassXC name is the project's trademark. (Quelle: Simple Icons, file keepassxc.svg (CC0))

A note on labels: verified means the statement is in the primary document (release notes, pull request, CVE entry). Inferred is our reading of it. Vendor-claimed is what the project says about itself.

Auto-Type on Wayland

Until now KeePassXC could not send input to other windows on Wayland, because Wayland does not let one application read or inject keyboard input of another. The release notes now say: “Linux: Add Wayland Auto-Type support using XDG Desktop Portals” (verified). The design decisions are in pull request 13359, merged on 20 June 2026:

Sequence as described in pull request 13359. The order is the one in the PR; we did not test it. (Quelle: GitHub, keepassxreboot/keepassxc, pull request 13359)

The pull request describes the global trigger as going through the system shortcuts portal provider. The connection to the remote desktop portal can either stay open or be rebuilt on every use, and rebuilding is the default. If the user does not answer the consent prompt, it times out after a while. The connection's restore token is kept in memory only by default and can optionally be stored in the local configuration.

Our reading (inferred): with the defaults (new connection on every use), expect frequent consent prompts from the desktop. That is a reasonable default for a tool that types passwords into other windows, but you will notice it in daily use. Anyone who stores the token permanently trades comfort for a longer-lived approval.

From the merge of the pull request on 20 June to the stable release on 21 October, 123 days passed, 95 of them until the first beta (our calculation from the dates in the pull request and the release).

Our calculation from the dates of pull request 13359 and GitHub release 2.8.0. (Quelle: GitHub, KeePassXC release 2.8.0)

There were rough edges before the release. A bug report about ignored characters in Auto-Type on Wayland (#13673) and one about the shortcut under Plasma after restarting KeePassXC (#13578) were last closed on 16 September, according to GitHub. The report about keyboard layouts with dead keys (#7881) was still open at the time of writing (24 October). If your passwords contain umlauts or accented characters, test that deliberately.

Database sync through external tools

The release notes say: “Add remote database synchronization and import using external tools”. According to linuxnews.de, this means KeePassXC does not bring its own cloud service. The notes do not say which protocols or programs are meant, so we cannot list WebDAV, Nextcloud or any other target as supported. The transport is your decision.

Two rules hold whatever way the file travels. Only one writer should be active at a time, otherwise you get conflict copies. After the switch to 2.8, the hash and modification time of the file show whether the Polkit quick-access feature has changed the database.

Polkit quick access changes the file

On Linux, quick access to the database now goes through Polkit. The release notes say that a UUID is written to the public metadata and that the database counts as modified on first start (verified). For admins that means the first open with 2.8 creates a new version of the file. Sync clients report a change, and other programs that read the same file (KeePassDX, Strongbox, KeePass2Android) see a different state.

Nothing says the KDBX format changes. Neither the notes nor the project’s blog entry mention a format change (inferred: none announced). KeePassXC shows the format under Database, Database Settings, Encryption, and KDBX 4 is the default. Put a copy aside before you first open the production database.

Qt 6 and other changes

The migration from Qt 5 to Qt 6 is in the release notes, and LWN reported on it on 22 October. For distributions it is the bigger intervention, because packages are built against different libraries. For users the notes name no single change in behavior.

The notes also list these points for admins (verified):

Linux: application state lives in XDG_STATE_HOME instead of XDG_CACHE_HOME.
Linux: there is a new AppImage for AArch64.
Windows: native Arm64 builds, and individual settings can be enforced through group policy.
The old conversion of KeePassHTTP attributes is removed.
A bug that froze the application on systems with one or two CPU cores is fixed.

Security fixes

The release closes several vulnerabilities. CVE-2026-69150 has a CVE entry (published 13 October): a use-after-free in the importer for KeePass 1 files (KDB) that, per the entry, allows a controlled write and a reliable crash in versions before 2.8.0-beta1. It is rated CVSS 4.0 base score 4.3 (medium), local attack vector, with user interaction. It can only be exploited if someone imports a crafted .kdb file.

For the browser extension, the GitHub entry lists two fixes: entry reference injection when creating or changing entries, and out-of-bounds writes when encrypting and decrypting native messaging messages. Further items concern Pageant (shared memory names) and an overflow in the old KDB importer. For these the notes still show “CVE-PENDING” placeholders, and the CVE numbers had not been assigned when we checked.

The project’s own rating reads: “The CVEs are rated low to moderate severity”, and none of them affects the core function or the cryptography (vendor-claimed, except CVE-2026-69150, whose rating comes from the CNA). According to linuxnews.de all versions up to 2.7.x are affected. That is a secondary source; the MITRE document names only versions before 2.8.0-beta1 for the KDB bug. The last 2.7 release in the GitHub list is 2.7.12 from 10 March.

What admins should check now

Check the version under Help, About. Update to 2.8.0 (distribution package, Flatpak, AppImage). Open a copy of the database first.
Update the browser extension at the same time and test the connection once under Settings, Browser Integration. The native messaging code was changed; we have not tested it.
On Wayland, bind the global trigger through the portal and grant the remote control consent. Then test with a password that contains umlauts or dead keys, because #7881 is still open.
For sync, choose the transport yourself, name one writer, and check the file’s hash and modification time after the switch.
Import .kdb files from unknown sources only after the update.