Cloudflare Network Firewall has a new managed rule to help mitigate the Linux IPv4 TCP use-after-free vulnerability (CVE-2026-98432 ↗︎): Rule name: Block CVE-2026-98432 traffic Rule ID: 6a4df2bf984946a88c74b07349557e83 The rule is disabled by default. To use it: Go to Networking > Firewall Policies > Managed Rulesets. Enable the rule with action Log first. Review traffic that matches the rule. If…
Private load balancers can now keep each user on the same endpoint. This helps with applications that keep session state on a single server. Cloudflare One Client or Cloudflare WAN siteConnects to 100.112.0.0Private load balancerPicks a healthy endpoint based on your steering policyHealth monitorsSteeringSession affinityPool 1Cloudflare Tunnel10.0.0.1vnet-aPool 2Cloudflare Mesh node10.1.0.1default…
Isolation policies now support a third keyboard option in beta: Allow read-only actions. Previously, the keyboard setting was binary — allow all input or block everything. With Allow read-only actions, you can block data entry while preserving the built-in browser actions your users depend on. In Allow read-only actions mode, users can still find in page, select all, copy, print, and zoom. All oth…
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
You can now assign key-value tags to Access service tokens and use those tags to organize credentials or control application access. Each token supports up to five tags, such as environment: production or team: payments. Add or edit tags when you create or update a token in the dashboard or service token API. You can search and filter by tag on the Service Tokens page. Tags also appear in Resource…
Cloudflare WAN traffic can now use a Gateway processing region with Regional Services. HTTPS traffic enters a Cloudflare data center (that may be outside the selected region) via an IPsec or GRE tunnel, or through Direct CNI, and remains encrypted until Gateway forwards it to the selected region for TLS decryption and HTTP inspection. This feature gives organizations control over where their sensi…
The SCIM population viewer lets you inspect the users and groups provisioned to Cloudflare One by each identity provider. You can check which resources Cloudflare has received without making API requests or opening a support ticket. In Zero Trust > Integrations > Identity providers, select a user or group count in SCIM resources to open the viewer. You can: Search users by username, email, name, o…
The Cloudflare dashboard now includes a Data Localization Suite Overview, a read-only view of the data localization settings on your account. It shows your Regional Services, Customer Metadata Boundary, and Geo Key Manager settings in one place, so you no longer need to check several dashboard pages and APIs to see where your traffic is processed and where your logs and private keys are stored. To…
System for Cross-domain Identity Management (SCIM) is an open standard that synchronizes user identities between an identity provider and a service. For more information, refer to SCIM provisioning. Google Workspace is rolling out custom SCIM profiles in beta. Organizations with access to the feature can use Google's built-in provisioning service to send user updates and deprovisioning events to C…
MCP tool-call analytics support a response_status query parameter on the account, portal, and server timeseries endpoints. Use success, error, or cached to count one status, or all to include every status. The default is success. Previously, counts included failed and cached calls. If you need the previous all-status counts, set response_status=all explicitly: GET /accounts/{account_id}/access/ai-…
Cloudflare Access now supports HTML and Liquid templates for login, identity-denied, forbidden, and command-line approval pages. Use templates to match your organization's branding and give users instructions relevant to the application or request. Create templates in the Cloudflare One dashboard, validate them in the editor, and assign them to applications or set account defaults. Liquid variable…
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page. This release includes the following highlights: Added automatic endpoint selection for Global Acceleration. When Global Acceleration is enabled for an organization, the client connects to the Global Acceleration endpoints while the device is in the acceleration region and to the standard…
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page. This release includes the following highlights: macOS 15.0 is now the minimum supported version. This release does not run on macOS 14. Added automatic endpoint selection for Global Acceleration. When Global Acceleration is enabled for an organization, the client connects to the Global Acce…
The Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is now generally available. You can grant a member read access and log streaming for specific Cloudflare Tunnel instances without granting write access or access to every Tunnel in your account. This role includes the same access as Cloudflare Tunnel - Granular Connector cloudflared Read: viewing selected Tunnels, their I…
Starting from version 2026.10.0, Cloudflare Tunnel can normalize URLs before matching ingress rules. This improves security for tunnels with rules that require Cloudflare Access validation. The URL path sent to your origin stays the same. In three months, starting 2027-01-25, new cloudflared releases will turn on URL normalization by default. Test your path-based routing before that date, as this…
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
Cloud Workload Security (CWS) is now available in Beta. Apply policy controls to cloud API requests before they reach your cloud provider. Define policies with request filters and Rego checks. For example, block requests that would make an R2 bucket public. Use workloads and policy sets to target your cloud environments. Manage your policies in the Cloudflare dashboard. Run the CWS proxy in your e…
Two changes make it easier to run Cloudflare Tunnel at scale. 50,000 routes per account by default The default limit for routes is now 50,000 per account, up from 1,000. This limit covers CIDR routes and hostname routes for Cloudflare Tunnel and Cloudflare Mesh. The new limit applies to every account automatically, with no action required. Published applications (public hostnames) are not routes a…
Cloudflare WAN and Magic Transit IPsec and GRE tunnels now support BGP import and export filtering. Create reusable filter profiles that specify an allow or deny action and a list of Classless Inter-Domain Routing (CIDR) targets with exact, more-specific, or prefix-length matching. Each tunnel supports one import filter and one export filter. You can create and assign profiles through the dashboar…
Cloudflare Gateway now integrates with Cloudflare Workers in public beta on all Zero Trust plans. You can use the Forward action in Gateway HTTP policies to run your own code on matching, permitted traffic without managing a separate proxy. The Forward action lets you transform HTTP requests and responses, return a coaching page, or run background tasks such as Slack notifications and R2 captures.…
Data loss prevention (DLP) custom pattern entries can use Cloudflare Workers in your account to validate matches with organization-specific logic. Your Worker can adjust a match's confidence or reject the match. For setup steps and the Worker contract, refer to Validate data loss prevention matches with Cloudflare Workers.
Starting today, you can create custom applications in the Application Library and reference them in Gateway DNS, Network, and HTTP policies. You can define an application with hostnames, IP subnets, or both. Then, optionally add TCP or UDP ports or port ranges to restrict HTTP and Network matching. This release also improves search and filtering in the Application Library, updates the interfaces,…
App-aware Cloudflare Access deny redirects include an account_id query parameter when account context is available. Custom block pages can use it to identify the account that owns the application represented by kid. For example, a custom redirect can include: https://denied.example.com/?kid=<APP_AUD>&account_id=<ACCOUNT_ID>&original_url=app.example.com%2Fadmin The account ID helps block-page integ…
Infrastructure applications now have a configurable session duration with a default value of 24 hours. You can set the session duration when creating or editing an infrastructure application in the dashboard or via the API. When the session duration elapses, any active SSH connections through that application will be closed, and users will need to reconnect. Previously, infrastructure applications…
You can now request DNS64 through Cloudflare Gateway DNS location settings or Extension Mechanisms for DNS (EDNS) options. DNS64 synthesizes AAAA records from A records for IPv6-only networks. These networks require network address translation from IPv6 to IPv4 (NAT64). Turn on Enable DNS64 for a location, or include an empty EDNS option 65051 in individual queries. Both mechanisms support UDP, TC…
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page. This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply.