KeePassXC 2.8.0 Released to Fix Multiple Security Vulnerabilities Affecting Password Manager

KeePassXC has released version 2.8.0 to address multiple security vulnerabilities related to database imports, browser integration, SSH key handling, and the protection of sensitive information.

Published on October 21, this update includes eight security fixes, platform improvements, and a migration to Qt 6. Notably, one vulnerability is identified as CVE-2026-69150, and four additional issues are awaiting CVE assignments.

KeePassXC 2.8.0 Released

According to Keepassxreboot, CVE-2026-69150 addresses a use-after-free vulnerability that occurs when importing specially crafted KDB files. Credited to researcher A. Ramos, this issue involves the legacy database import path.

The release also fixes an integer overflow and out-of-bounds read in the legacy KDB importer, reported by Viktor Markopoulos from the NATO Cyber Security Center. Both fixes target unsafe memory operations during database processing.

The update includes two important security corrections for browser integration. The first fix prevents entry reference injection when the browser extension creates or updates entries.

This vulnerability, reported by Davonte (also known as BadPingHere), pertains to the handling of references within browser-driven entry operations.

The second fix resolves out-of-bounds writes that occur during the encryption and decryption of native messaging messages, credited to researcher sigure21. Both issues are marked as CVE-PENDING in the release notes.

The changelog does not provide severity scores, details on exploitation prerequisites, or evidence of active exploitation for these vulnerabilities. Thus, the documented memory corruption issues should not be automatically classified as confirmed remote code execution flaws.

On Windows, KeePassXC now randomizes shared memory mapping names when transferring SSH keys to Pageant. This change addresses another issue, also credited to Markopoulos and the NATO Cyber Security Center, with a pending CVE identifier.

Additionally, the update corrects the format name used for excluding items from the Windows clipboard.

New Features

Feature	Platform	Description
Remote database synchronization and import	Cross-platform	Adds database synchronization and import using external tools.
Configurable keyboard shortcuts	Cross-platform	Allows users to customize keyboard shortcuts.
SSH key generation	Cross-platform	Adds support for generating RSA, ECDSA, and Ed25519 keys through SSH Agent functionality.
Wayland Auto-Type	Linux	Enables Auto-Type on Wayland using XDG Desktop Portals.
Polkit-based Quick Unlock	Linux	Adds Quick Unlock using Polkit. A database UUID is added to public metadata, marking the database as modified on first launch.
AArch64 AppImage	Linux	Adds an AppImage package for AArch64 systems.
Device-password Quick Unlock	macOS	Allows Quick Unlock using the device password when Touch ID is unavailable.
Group Policy overrides	Windows	Enables administrators to enforce selected user settings through global Group Policy overrides.
Native Arm64 builds	Windows	Adds native application builds for Windows Arm64 systems.

Further enhancements exclude protected attributes from Secret Service attribute listings and improve the clearing of decrypted database fragments from memory utilized by zlib.

These changes reinforce the handling of sensitive information across integration interfaces and temporary processing buffers. The Secret Service correction is credited to Koda Reef, while ByeWhiteLists is credited with the clipboard fix.

In addition to security fixes, version 2.8.0 introduces features such as remote database synchronization, import via external tools, configurable keyboard shortcuts, and the ability to generate RSA, ECDSA, and Ed25519 keys.

For Linux users, the update includes Wayland Auto-Type via XDG Desktop Portals, Polkit-based Quick Unlock, and an AArch64 AppImage. Windows users get native Arm64 builds, and Group Policy overrides to enforce selected settings.

Other improvements include password strength evaluation for referenced passwords, preserving the selected database when saving new passkeys, and fixing several Secret Service crashes.

Users should prioritize upgrading, especially if they are using legacy KDB imports, browser integration, or Pageant workflows. The release notes don’t mention any interim workarounds, so installing this corrected version is the most direct fix for these issues.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.