更新日志

A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page.

This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers. The client now sends fallback DNS queries over UDP first, falling back to TCP only when a response is truncated, instead of querying both protocols in parallel.

A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page.

This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers. The client now sends fallback DNS queries over UDP first, falling back to TCP only when a response is truncated, instead of querying both protocols in parallel.

A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page.

This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers. The client now sends fallback DNS queries over UDP first, falling back to TCP only when a response is truncated, instead of querying both protocols in parallel.

Cloudflare Access 现在对通过端口 80 上的明文 HTTP 提供服务的私有应用程序使用标准的基于浏览器的登录流程。

以前，明文 HTTP 私有应用程序会回退到与 SSH、RDP 和其他非 HTTP 协议相同的会话流程：用户会从 Cloudflare One Client 收到一个“需要身份验证（Authentication required）”弹窗，然后必须选择该通知以打开浏览器并登录。现在，访问 HTTP 私有应用程序的用户会直接在浏览器中看到 Access 登录页面，并在成功后收到标准的 Access 应用程序令牌（application token）。

这使得 HTTP 体验与 HTTPS 应用程序（开启了 Gateway TLS 解密）保持一致。无需更改配置。仍然需要 Cloudflare One Client 将流量路由到私有网络，但它不再管理 HTTP 应用程序的 Access 会话。

其他非 HTTP 协议（SSH、RDP、任意 TCP/UDP）继续使用 Cloudflare One Client 通知流程。

Cloudflare Gateway 现在支持在允许策略上进行高级请求头控制。管理员可以使用静态值或动态变量来添加、重写或删除匹配请求上的请求头。

使用“允许”（Allow）操作的 Gateway HTTP 策略在 rule_settings 中支持三种操作：

Gateway 按以下顺序应用操作：首先删除，然后重写，最后添加。

请求头的值可以包含使用 @{...} 语法的动态变量。Gateway 会在请求时根据身份、设备和网络上下文解析变量。

您可以在单个请求头值中混合使用静态文本和动态变量。例如，user-@{identity.email} 会解析为 [email protected]。

有关更多信息，请参阅自定义请求头。

在基于浏览器的 RDP 会话中，用户现在可以将多个 PDF 文件作为单个打印作业进行打印。在远程计算机上将文件复制到剪贴板，然后选择剪贴板面板中的 Print all PDFs（打印所有 PDF）。这些文件将合并为一个 PDF 并发送到您的本地打印机。

批量打印在基于 Chromium 的浏览器和 Firefox 中可用。欲了解更多信息，请参阅为基于浏览器的 RDP 打印 PDF。

内部 DNS 现在已正式发布。内部 DNS 在您已用于公共 DNS、Zero Trust 和应用程序服务的同一个全球网络和控制平面上，为私有网络提供权威和递归 DNS 服务。

• 整合 DNS 运营。 公共和私有 DNS 运行在同一个平台上，拥有统一的 API、审计跟踪和策略设置入口。
• 简化水平分割 DNS。 内部和外部解析被定义为共享区域上独立的视图，并从单个控制平面进行管理 — 因此无需排查配置偏差。
• 将 Zero Trust 扩展到 DNS。 解析器策略决定哪些用户和设备针对哪个视图进行解析，并由已经监管您其余流量的同一个 Gateway 来执行。

设置内部 DNS 需要三个步骤：创建区域、创建视图并定义解析器策略。

POST /zones
{
  "account": {
    "id": "<ACCOUNT_ID>"
  },
  "name": "corp.internal",
  "type": "internal"
}

内部 DNS 已包含在面向企业级客户的 Cloudflare Gateway 中。要开始使用，请参阅 Internal DNS documentation。

数据丢失防护 (DLP) 源代码检测现在专注于识别整个源代码文件的上传和下载。以前，源代码检测执行部分扫描，导致误报率较高。由于现在仅对整个源代码文件进行评估，因此嵌入在其他内容（例如聊天消息、文档或代码示例）中的代码不再被标记为源代码，从而消除了常见的误报来源。

源代码检测需要至少 500 个字符来评估文件。低于此阈值的文件不会被标记，以减少噪点。此阈值过滤掉了缺乏足够上下文以进行可靠分类的小片段。

启用并设置置信度级别以调整匹配敏感度。较高的置信度级别通过需要更强烈的信号来表明内容确实是源代码，从而减少误报。较低的置信度级别会捕获更多文件，但代价是会产生额外的噪点。

源代码检测适用于 Gateway HTTP 策略中的独立源代码文件。它不会检测嵌入在其他文件类型或有效负载（例如 .docx 文件或聊天消息）中的源代码。

有关更多详细信息，请参阅 Source Code predefined profiles。

在 2026 年 10 月 5 日，两项变更将在 Zero Trust Networks API 和 Cloudflare Tunnel API 中生效：移除经过 CIDR 编码的路由终点，且 tunnel list 和 get 响应将不再包含 connections 字段。如果您通过 API、cloudflared、Terraform 或其他集成管理私有网络路由或读取 tunnel 连接详情，请阅读以下部分中的变更说明并在移除日期之前完成迁移。

经过 CIDR 编码的路由终点已被弃用，转而使用目前已存在的基于标准 route_id 的终点。这两组终点都是通过 Cloudflare Tunnel 或 Cloudflare Mesh 路由私有网络（API 仍将 Mesh 节点称为 warp_connector）— 仅请求形状（request shape）发生了变化。

已弃用的终点（将于 2026 年 10 月 5 日移除）：

• 创建 tunnel 路由（CIDR 终点）：POST /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}
• 更新 tunnel 路由（CIDR 终点）：PATCH /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}
• 删除 tunnel 路由（CIDR 终点）：DELETE /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}

替代终点：

• 创建 tunnel 路由：POST /accounts/{account_id}/teamnet/routes
• 更新 tunnel 路由：PATCH /accounts/{account_id}/teamnet/routes/{route_id}
• 删除 tunnel 路由：DELETE /accounts/{account_id}/teamnet/routes/{route_id}

1. 通过调用列出 tunnel 路由获取每个路由的 route_id，或者在首次使用替代终点创建路由时从响应中读取它。
2. 更新任何直接调用经过 CIDR 编码的终点的脚本、后端服务或 CI/CD 流水线。
3. 如果您使用 cloudflared tunnel route ip add | delete 命令管理路由，请将 cloudflared 升级到最新版本 ↗。
4. 如果您使用 Terraform 管理路由，请确保您使用的是最新版本的 cloudflare_zero_trust_tunnel_cloudflared_route ↗ 资源以及 Cloudflare Terraform 提供商 ↗。

# Before: create a route by URL-encoding the CIDR into the path
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/network/172.16.0.0%2F16 \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}'

# After: create a route with the network in the request body
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"network": "172.16.0.0/16", "tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}'

# After: update or delete a route using its route_id
curl -X PATCH https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"comment": "Updated comment for this route."}'

curl -X DELETE https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

自同一天起，将从 Cloudflare Tunnel 和 Cloudflare Mesh 节点（cfd_tunnel 和 warp_connector API 资源）的 list 和 get 响应中移除 connections 数组。请查询专用的连接终点，而不是从 tunnel 或节点对象中读取该字段。

这会影响：

• GET /accounts/{account_id}/cfd_tunnel — 从 result 中的每个项目中移除 connections
• GET /accounts/{account_id}/cfd_tunnel/{tunnel_id} — 从 result 中移除 connections
• GET /accounts/{account_id}/warp_connector — 从 result 中的每个项目中移除 connections
• GET /accounts/{account_id}/warp_connector/{tunnel_id} — 从 result 中移除 connections

从特定于 tunnel 的连接终点获取连接详情，而不是从 list 或 get 响应中解析。对于 Cloudflare Tunnel，请调用 GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/connections。对于 Cloudflare Mesh，请调用 GET /accounts/{account_id}/warp_connector/{tunnel_id}/connections。

# Before: read connections off the tunnel object
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

# After: query connections directly
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID/connections \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

更新任何从 tunnel list 或 get 响应中解析 connections 的仪表板、监控脚本或自动化。cloudflared 和 Cloudflare Terraform 提供商不读取此字段，因此它们的这一部分更新不需要做任何更改。

• 响应更小、速度更快。 具有许多连接的 Cloudflare Tunnel 和 Cloudflare Mesh 节点不再膨胀每次 list 和 get 调用 — 仅在您需要时才获取连接详情。
• 静态或标识路由的单一方式。 统一使用 route_id 消除了对路径中 CIDR 范围进行 URL 编码的需要，并且与 Zero Trust Networks API 中所有其他资源的寻址方式一致。
• 跨 API 的一致性。 这两项变更使这些终点与 Cloudflare 针对资源标识符和嵌套详情终点的标准 REST 约定保持一致。

要了解更多信息，请参阅 Zero Trust Networks API、Cloudflare Tunnel API 和路由文档。

Cloudflare IPsec 现在支持 IKE_SA_INIT_FULL_TRANSCRIPT_AUTH ↗ IKEv2 扩展，以防御 IPsec 隧道上的降级攻击。

IKEv2 的原始身份验证设计是让每个端点仅对其自己的出网消息进行签名，而不是对完整的握手脚本进行签名。具有量子计算能力的路径上（on-path）攻击者 ↗可以利用这一点，通过将连接降级为传统密码学，从而绕过后量子密钥交换。IKE_SA_INIT_FULL_TRANSCRIPT_AUTH 扩展通过在身份验证交换期间让双方对整个握手脚本进行签名来解决此问题，从而防止攻击者在不被发现的情况下操纵协商。

关键详情：

• 在 Cloudflare WAN 和 Magic Transit IPsec 隧道中提供 Beta 版。
• 启用该功能标志后，Cloudflare 会作为响应方（responder）无条件发送 IKE_SA_INIT_FULL_TRANSCRIPT_AUTH 通知。
• 发起方（您的设备）和响应方（Cloudflare）都必须支持该扩展，降级保护才能生效。
• 此功能目前由每个账户的功能标志控制。请联系您的账户团队将其开启。

请参阅降级保护了解更多详情。

A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page.

This hotfix addresses a Windows authentication issue in the embedded WebView2 browser. Single sign-on could fail to use the Windows primary account, causing users to be prompted for an interactive sign-in. The embedded authentication browser now allows SSO providers to use the OS primary account when available.

您现在可以为使用 Cloudflare Access 的基于浏览器的 RDP 配置文件传输控制，允许您限制用户是否可以在其本地计算机与远程 Windows 服务器之间上传或下载文件。

对于支持自带设备（BYOD）政策或使用未托管设备的第三方承包商的组织，此功能非常有用。通过限制文件传输，您可以防止敏感数据从远程会话转移到用户的个人设备。

文件传输控制在您的 Access 应用程序中针对每个策略进行配置，与现有的文本剪贴板控制并列。对于每个策略，您可以选择以下选项之一：

• 允许从客户端到远程 RDP 会话 — 用户可以从其本地计算机上传文件到基于浏览器的 RDP 会话中。
• 允许从远程 RDP 会话到客户端 — 用户可以从基于浏览器的 RDP 会话下载文件到其本地计算机中。
• 允许双向 — 用户可以在其本地计算机与基于浏览器的 RDP 会话之间上传和下载文件。
• 禁用复制/粘贴 — 不允许用户在其本地计算机与基于浏览器的 RDP 会话之间传输文件。

默认情况下，新策略的文件传输功能是被拒绝的。对于在此功能可用之前创建的现有 Access 应用程序，文件传输依然被拒绝。

要上传，请将文件拖入浏览器窗口，或选择 RDP 会话左侧的设置齿轮图标。要下载，请在远程会话中复制文件，然后选择设置齿轮以进行下载、将多个文件下载为 zip 包，或者将 PDF 打印到本地打印机。

此功能处于 Beta 阶段，可在所有 Zero Trust 方案中使用。欲了解更多信息，请参阅基于浏览器的 RDP 的文件传输。

浏览器隔离现在支持 Gateway 授权代理端点。您可以对通过授权代理端点路由的流量应用 HTTP 隔离策略，方式与对来自 Cloudflare One 客户端的流量相同。

此前，只有源 IP 代理端点支持浏览器隔离，且仅支持非基于身份的策略。由于授权代理端点通过身份提供商对用户进行认证，您现在无需 Cloudflare One 客户端即可对 PAC 文件代理流量应用基于身份的隔离策略。

如需开始，请创建授权代理端点并构建隔离策略。

您现在可以直接从仪表板注册 Cloudflare One 虚拟 Appliance 并生成其许可证密钥，而无需联系您的账户团队。

• 在 Connectors（连接器） 页面上，选择 Add an appliance（添加设备） 并选择 Virtual appliance（虚拟设备） 以注册虚拟 Appliance 并生成其身份验证密钥。
• 从虚拟 Appliance 连接器的菜单中，使用 Regenerate authentication key 来轮换其密钥。先前的密钥会立即且不可逆地撤销。
• 身份验证密钥仅显示一次——请复制并妥善保存。

这对现有的用于配置虚拟 Appliance 的 API 和 Terraform 自助服务工作流进行了补充。硬件 Appliance 继续使用现有的账户团队履行工作流。

有关详细信息，请参阅配置 Cloudflare One 虚拟 Appliance。

除了 CIDR 路由之外，您现在还可以向 Cloudflare Mesh 节点添加主机名路由。

您可以通过将主机名的流量引导到 Mesh 节点来代替管理 IP 范围：

• 私有主机名（例如 wiki.internal.local）—— 通过名称访问内部应用程序，这在它具有未知或临时 IP 时非常有用。在 Mesh 上，您不需要运行 DNS 服务器；只需节点上的本地 hosts 文件条目即可，或者您可以使用 Gateway 解析器策略进行 split DNS。
• 公共主机名（例如 www.example.com）—— 通过该节点路由该主机名的流量，并经由该节点的公共 IP 出站。

有关设置步骤、先决条件和 DNS 选项，请参阅主机名路由。

A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page.

This package is the same release as 2026.6.822.0, with a fix for our RPM package. Previously the repository served a single build to every OS version, so an install could pull a dependency that isn't available on that release. The repository now serves the correct build for each operating system version, so installs automatically pull the dependencies that version requires. Debian and Ubuntu were not affected.

If you installed version 2026.6.822.0 on an RPM-based distribution, we recommend refreshing your repository configuration:

sudo curl -fsSL https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | sudo tee /etc/yum.repos.d/cloudflare-warp.repo
sudo dnf clean all
sudo dnf install cloudflare-warp

Access 现在在登录后将用户重定向回应用程序时，能够正确保留 URL 片段（fragment）字符（/、?、=、&、;）。以前，这些字符是使用 encodeURIComponent 进行编码的，这会破坏单页应用程序（SPA）使用的基于片段的路由。

例如，像 https://app.example.com/#/dashboard?tab=settings&view=advanced 这样的 SPA URL 以前在登录后会重定向到一个损坏的 URL。这现在已得到正确处理。

如果您的 SPA 用户在通过 Access 进行身份验证后遇到导航损坏的问题，此修复将解决该问题，而无需进行任何配置更改。

Access for Infrastructure 现在支持使用 YubiKey PIV 密钥对 SSH 连接实施独立多因素身份验证（MFA）。这为 SSH 访问添加了基于硬件的第二因素，确保仅凭受损的设备会话不足以访问您的服务器。

通过针对每个应用程序和每个策略的配置，您可以对敏感用户名（例如 root）强制执行 PIV 密钥身份验证，同时对其他用户名应用不同的要求。您还可以设置 MFA 会话时长，以控制用户必须重新进行身份验证的频率。

用户通过应用程序启动器注册其 YubiKey PIV 密钥。有关注册说明和 SSH 客户端设置，请参阅为基础设施应用程序注册 PIV 密钥。

有关设置说明，请参阅为基础设施应用程序强制执行 MFA。

您现在可以为 Cloudflare Gateway 防火墙策略和 Zero Trust 列表分配细粒度的资源作用域角色。管理员可以委派对特定策略类型或列表管理的访问权限，而无需授予账户范围或产品范围的控制权。

当您添加成员或创建权限策略时，现在可以使用以下资源作用域角色：

这些角色允许您：

• 仅向网络工程师授予网络策略的写入权限，而不暴露 DNS 或 HTTP 策略配置。
• 允许安全分析师以只读模式查看所有 Gateway 策略以进行审计。
• 将列表管理委托给维护阻止和允许列表的团队，而不授予他们访问策略配置的权限。

您现在还可以分配 资源作用域角色。这些角色是对现有账户级别角色的补充，允许您授予对特定资源（例如单个 Gateway 策略或 Cloudflare One 列表）的访问权限。现有的账户级别角色继续有效。 拥有 Cloudflare Gateway 或 Cloudflare Zero Trust 角色的成员将保留对所有 Gateway 资源的完全访问权限。这确保了与现有自动化和 API 令牌的向后兼容性。

• 查看 Cloudflare 角色参考上的资源作用域角色。
• 了解如何创建使用这些角色的权限策略。

A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page.

This release introduces multiple features from our previous beta release into stable release, including:

• The client now applies DNS search suffixes configured in your device profile / network policy. Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See DNS search suffixes for details.
• Added mandatory authentication. When enabled via MDM, the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates, closing the visibility gap on newly deployed devices and during re-authentication. See the announcement blog and documentation for details.
• Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See Hardware-backed registration for details.
• Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume.
• Added new warp-cli debug commands for interactive connection diagnosis. See Extra debug logging for details.
• The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client.
• Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated Cloudflare One MDM documentation for details.
• Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See Client version assignments for details.

Additional Changes and improvements

• Starting with 2026.6.822.0, the client unifies all API requests under the api.devices.cloudflare.com SNI, where previously both zero-trust-client.cloudflareclient.com and notifications.cloudflareclient.com were used. Review Cloudflare One Client with firewall to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected.
• Client Certificate device-posture checks now support template variables (e.g. ${serial_number}, ${device_uuid}) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry.
• Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in Windows Accessibility settings.
• Path MTU Discovery (PMTUD) is now enabled by default.
• The UseWebView2 registry value (HKLM\SOFTWARE\Cloudflare\CloudflareWARP\UseWebView2 = y) is once again honored by the new GUI for authentication, so administrators who prefer the embedded WebView2 browser for sign-in can opt back in. This setting was effectively ignored in the previous release; the default browser was always used. This key is now also honored for re-authentications.
• Fixed a crash in the authentication browser when navigating to a site that prompts for browser permissions (microphone, camera, notifications, etc.). The same fix had previously landed for the captive-portal browser; this extends it to the auth browser.
• Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests.
• Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry.
• Fixed a high CPU issue when the device wakes from sleep.
• Users can now register with team names in any case format without errors.
• New UI fixes
  • Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication.
  • Added a re-auth button and banner to the home screen so users don't miss it when their session expires.
  • Added clear error messaging when the Cloudflare certificate needs to be installed.
  • Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users.
  • New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration.
  • Added ability to configure proxy mode for consumer users.
  • Added back the option to quit for consumer users.

Known issues

• Single sign-on in the embedded WebView2 authentication browser may fail to use the Windows primary account, prompting for an interactive sign-in.
• An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed.
• In rare cases, a registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
• Windows ARM may prompt the user to close running applications while trying to install this version. Simply click "Ok" with the default highlighted option.

A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page.

This release introduces multiple features from our previous beta release into stable release, including:

• The client now applies DNS search suffixes configured in your device profile / network policy. Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See DNS search suffixes for details.
• Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation. See Hardware-backed registration for details.
• Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume.
• Added new warp-cli debug commands for interactive connection diagnosis. See Extra debug logging for details.
• The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client.
• Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated Cloudflare One MDM documentation for details.
• Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See Client version assignments for details.

Additional Changes and improvements

• Starting with 2026.6.822.0, the client unifies all API requests under the api.devices.cloudflare.com SNI, where previously both zero-trust-client.cloudflareclient.com and notifications.cloudflareclient.com were used. Review Cloudflare One Client with firewall to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected.
• Client Certificate device-posture checks now support template variables (e.g. ${serial_number}, ${device_uuid}) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry.
• Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the macOS Display settings.
• Path MTU Discovery (PMTUD) is now enabled by default.
• Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser.
• Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests.
• Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry.
• Users can now register with team names in any case format without errors.
• New UI fixes
  • Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication.
  • Added a re-auth button and banner to the home screen so users don't miss it when their session expires.
  • Added clear error messaging when the Cloudflare certificate needs to be installed.
  • Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users.
  • New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration.
  • Added ability to configure proxy mode for consumer users.
  • Added back the option to quit for consumer users.

Known issues

• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
• When deploying with Microsoft Intune, the client may be repeatedly reinstalled because Intune adds the client's embedded framework bundles to its install-detection list, and those frameworks cannot be detected as installed on their own. See Repeated reinstalls on macOS with Microsoft Intune for the workaround.

A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page.

This release introduces multiple features from our previous beta release into stable release, including:

• The client now applies DNS search suffixes configured in your device profile / network policy. Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See DNS search suffixes for details.
• Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See Hardware-backed registration for details.
• Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume.
• Added new warp-cli debug commands for interactive connection diagnosis. See Extra debug logging for details.
• The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client.
• Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated Cloudflare One MDM documentation for details.

Additional changes and improvements

• Starting with 2026.6.822.0, the client unifies all API requests under the api.devices.cloudflare.com SNI, where previously both zero-trust-client.cloudflareclient.com and notifications.cloudflareclient.com were used. Review Cloudflare One Client with firewall to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected.
• Cloudflare Mesh functionality using the Cloudflare One Client is now supported on RHEL 9 and 10.
• Cloudflare Mesh now supports hostname-based routing.
• Client Certificate device-posture checks now support template variables (e.g. ${serial_number}, ${device_uuid}) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry.
• Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the system display settings.
• Path MTU Discovery (PMTUD) is now enabled by default.
• Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser.
• Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests.
• Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry.
• Fixed an issue where some Debian releases experienced inaccurate version reporting for posture checks.
• Users can now register with team names in any case format without errors.
• New UI fixes
  • Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication.
  • Added a re-auth button and banner to the home screen so users don't miss it when their session expires.
  • Added clear error messaging when the Cloudflare certificate needs to be installed.
  • Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users.
  • New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration.
  • Added ability to configure proxy mode for consumer users.
  • Added back the option to quit for consumer users.

For RHEL deployments, this release introduces a dependency on the Extra Packages for Enterprise Linux repository (EPEL). The EPEL repository provides packages that support the captive portal detection’s in-app browser authentication and system tray icon. See Getting started with EPEL for instructions on enabling EPEL.

Known issues

• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.

您现在可以使用 Access service token 将自主 Agent 和机器人连接到 MCP 服务端门户。Service token 会话可以通过门户访问上游 MCP 服务端，而无需基于浏览器的 OAuth 流程。

要进行此设置：

• 将与您的 service token 匹配的 Service Auth 策略添加到门户的 Access 应用程序。
• 将与相同 token 匹配的 Service Auth 策略添加到每个关联的 MCP 服务端的 Access 应用程序。
• 将每个关联服务端的 **Require user auth（需要用户身份验证）**关闭（on_behalf: false），以便门户使用管理员凭证，而不是每个用户的 OAuth 授权。

机器人使用 CF-Access-Client-Id 和 CF-Access-Client-Secret 请求头进行连接，并可以看到其获得授权的每个关联服务端中的工具。仍然需要每个用户 OAuth 的服务端将被排除在 service token 会话之外，因为 service token 无法完成每个用户的 OAuth 授权。

有关逐步设置，请参阅使用 service token 进行连接。

A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page.

This beta release introduces upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation.

Additional changes and improvements

This release also introduces multiple fixes and improvements including:

• Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the macOS Display settings.
• Path MTU Discovery (PMTUD) is now enabled by default.
• Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry.
• Users can now register with team names in any case format without errors.
• New UI fixes
  • Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication.
  • Added a re-auth button and banner to the home screen so users don't miss it when their session expires.
  • Added clear error messaging when the Cloudflare certificate needs to be installed.
  • Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users.
  • New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration.
  • Added ability to configure proxy mode for consumer users.
  • Added back the option to quit for consumer users.

Known issues

• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.

Regional Services 现在支持 Regionalized IP Bindings，让您能够针对通过 Bring Your Own IP (BYOIP) 引入 Cloudflare 的前缀在 IP 层实现流量区域化。

Regional Hostnames 是按主机名对流量进行区域化，而 Regionalized IP Bindings 允许您将来自前缀之一的 CIDR 绑定（binding）到某个区域 —— 这非常适合地址映射部署以及任何您通过 IP 而非主机名寻址的服务。然后，Cloudflare 会在 TLS 终止后，仅在该区域的数据中心内处理发往这些地址的流量。

Regionalized IP Bindings 需要 Regional Services 和 Regional Services for BYOIP 的授权。请联系您的账户团队以启用它们。

要开始使用，请参阅 Regionalized IP Bindings。