更新日志

Cloudflare 仪表板中的 **Routes（路由）**页面现在在单个表格中显示您所有连接器的路由——包括 Cloudflare Mesh 和 Cloudflare Tunnel 路由，以及 Cloudflare WAN 和 Magic Transit 静态路由，而不是每个产品分别显示独立的路由视图。

在统一的 Routes 页面中，您可以：

• 通过交互式地图可视化您的网络，该地图显示了您的目的地如何流向您的连接器——包括由多个连接器提供相同前缀服务的等价多路径（ECMP）路由。选择一个节点以过滤表格以显示其后面的路由。
• 在单个表格中查看每条路由，及其目的地、类型、连接器、优先级和来源，并进行过滤或排序以找到您需要的内容。
• 创建、编辑和删除路由（支持任何受支持的类型），而无需离开页面。添加 Cloudflare WAN 或 Magic Transit 静态路由时，您现在可以通过连接器名称选择下一跳，而无需输入其 IP。
• 在专用选项卡中管理虚拟网络。
• 测试路由，以便在提交更改之前查看目的地解析为哪个连接器和下一跳。

要找到它，请前往仪表板侧边栏中的 Networking（网络） > Routes（路由）。

您现有的路由、API 和配置保持不变——这是一个将它们聚集在一个地方的仪表板体验。了解如何添加路由和管理虚拟网络。

当您创建新的 Zero Trust 组织时，Cloudflare 现在会将 Cloudflare 身份提供商添加为您的默认登录方式。先前，新的组织会以 一次性 PIN 码 (OTP) 开始。

使用 Cloudflare 身份提供商，您的用户将使用其现有的 Cloudflare 账户凭证进行身份验证，并且身份验证仅限于您账户的成员。您仍然可以在需要时随时添加 OTP 或连接任何第三方身份提供商。

此更改仅适用于新创建的账户。现有组织将保留其已配置的登录方式。如果您想在现有账户中使用 Cloudflare 身份提供商，则必须将其启用。

您现在可以为 AI 提示词保护定义自定义主题。预定义的 AI 提示词主题涵盖了常见的生命周期和意图类别，例如 PII、源代码和越狱（jailbreak）尝试。自定义主题允许您检测未包含在预定义类别中的独特或专有概念。

您用自然语言描述一个自定义主题，Cloudflare DLP 会根据上下文（而非特定关键字）检测提示词是否与该主题匹配。例如，描述机密合并讨论的主题会与对该交易进行释义的提示词相匹配，即使该提示词从未包含“合并”一词或涉及的公司名称。要检测诸如内部代号或产品标识符之类的字面值，请改用自定义单词列表或模式条目。

自定义主题与预定义的 AI 提示词主题运行相同的应用程序精细控制路径。自定义主题适用于 ChatGPT、Google Gemini、Perplexity 和 Claude。

1. 在 Cloudflare 仪表板 ↗中，转到 Zero Trust > Data loss prevention（数据防泄露） > Detection entries（检测条目）。
2. 选择 AI prompt topics（AI 提示词主题），然后选择 Custom Prompt Topic（自定义提示词主题）。
3. 用自然语言描述主题。具体说明您想要检测的概念。例如，描述未发布的产品路线图细节或机密的客户合同条款。
4. 将此检测条目添加到现有的 DLP 配置文件中，或创建一个新的 DLP 配置文件。
5. 在 Gateway HTTP 策略中使用该配置文件，以记录或阻断与该主题相匹配的提示词。

有关更多详细信息，请参阅 AI prompt topics。

使用 VPC 网络（VPC Network） 绑定（binding）与 network_id: "cf1:network" 的 Workers 现在可以通过 Cloudflare Gateway 出口到公共互联网目标。这意味着您现有的 Zero Trust 流量策略 —— DNS、HTTP、网络和出口（egress）—— 将延伸到源自您的 Workers 的流量，就像今天对 WARP 用户所做的那样。

您默认获得的内容：

• 可见性。 Worker 出口流量与您的其他流量一起显示在 Gateway DNS、HTTP 和 网络 日志中，以便您可以审计您的 Workers 在何时调用了什么。
• 强制执行。 任何其选择器与 Worker 请求相匹配的现有 Gateway 策略都将适用 —— 包括允许/阻止列表、DNS 类别过滤和 HTTP 目标规则。如果您已经为您的员工屏蔽了某个类别，您的 Workers 将继承该屏蔽。

{
	"vpc_networks": [
		{
			"binding": "EGRESS",
			"network_id": "cf1:network",
			"remote": true,
		},
	],
}

[[vpc_networks]]
binding = "EGRESS"
network_id = "cf1:network"
remote = true

// Egress to a public destination — subject to your Gateway policies and logged
const response = await env.EGRESS.fetch("https://api.example.com/data");

// Egress to a public destination — subject to your Gateway policies and logged
const response = await env.EGRESS.fetch("https://api.example.com/data");

有关配置选项，请参阅 VPC 网络（VPC Networks）。有关策略编写，请参阅 Cloudflare Gateway 流量策略。

Cloudflare Access 现在支持 IdP 联合，这允许组织在多个 Cloudflare 账户之间共享单个身份提供商。

无需在每个账户中分别配置相同的 IdP（例如 Okta 或 Entra ID），您只需在源账户中配置一次，然后与组织中的其他账户共享它。每个接收方账户都会获得一个只读的 IdP 连接，该连接通过一个桥接（bridge）—— 源账户中一个代理跨账户登录的隐藏应用程序 —— 将身份验证路由回源账户。最终用户使用其现有的 IdP 凭据登录，而每个账户的 Access 策略评估生成的身份就和任何其他 IdP 登录一样。

关键功能：

• 一个 IdP，多个账户 — 配置一次您的 IdP，并将其共享给您组织中的所有账户。
• 生命周期管理 — 随着账户加入或离开您的 Cloudflare 组织，它们的 IdP 连接会自动预配和删除 —— 无需手动清理。
• 不可变的接收方连接 — 接收方账户中的 IdP 连接不能被意外修改或删除。

要开始使用，请参阅 IdP 联合。

Cloudflare Access 现在支持身份提供商集成的 SAML 断言（assertion）加密。开启后，您的身份提供商会在通过用户浏览器发送 SAML 断言之前，使用 Cloudflare 管理的证书对其进行加密。只有 Access 可以解密这些断言，从而在 TLS 终止后也能保护敏感的身份数据。

如果没有加密，SAML 断言将以明文传输，并且可能会被浏览器扩展或客户端恶意软件看到。

SAML 加密包括内置的证书生命周期管理：

• 自动生成证书：当您为身份提供商开启 SAML 加密时，Access 会生成一个加密证书。
• 证书轮换：无停机轮换证书。之前的证书在过期前保持有效，为您留出时间来更新 IdP。
• PEM 导出：复制 PEM 格式的证书以便手动上传到您的 IdP，或者将您的 IdP 指向 SAML 元数据端点以进行自动检索。

要开始使用，请参阅加密 SAML 断言。

用于 Cloudflare WAN 的 Cisco IOS XE 第三方集成指南已更新，包含以下内容：

• 后量子密码学 (PQC)
• 策略路由 (PBR)
• IP 服务水平协议 (IP SLA)

此链接将直接带您进入已更新的 Cisco IOS XE 指南。

A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page.

This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:

• Right click context menu to access the most common client actions quickly
• Built-in captive portal login experience

Additional Changes and improvements

• The client now applies DNS search suffixes configured in your device profile / network policy. Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See DNS search suffixes for details.
• Administrators can now control which virtual networks (VNETs) are available to which users via WARP device profile settings in the Zero Trust dashboard. Previously, every VNET in the organization was visible to every device; you can now scope the VNET picker per profile so users only see the networks relevant to them. See VNET availability for details.
• Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume.
• Added new warp-cli debug commands for interactive connection diagnosis. See Extra debug logging for details.
• The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client.
• Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated Cloudflare One MDM documentation for details.
• Client Certificate device-posture checks now support template variables (e.g. ${serial_number}, ${device_uuid}) in the Subject Alternative Name field, matching what the documentation has always claimed. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry.
• Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks (United inflight Wi-Fi was the reported case). The browser now reliably loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser.
• Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests.

Known issues

• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
• Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.

A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page.

This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:

• Right click context menu to access the most common client actions quickly
• Built-in captive portal login experience

Additional Changes and improvements

• The client now applies DNS search suffixes configured in your device profile / network policy. Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See DNS search suffixes for details.
• Administrators can now control which virtual networks (VNETs) are available to which users via WARP device profile settings in the Zero Trust dashboard. Previously, every VNET in the organization was visible to every device; you can now scope the VNET picker per profile so users only see the networks relevant to them. See VNET availability for details.
• Added mandatory authentication. When enabled via MDM, the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates, closing the visibility gap on newly deployed devices and during re-authentication. See the announcement blog and documentation for details.
• Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume.
• Added new warp-cli debug commands for interactive connection diagnosis. See Extra debug logging for details.
• The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client.
• Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated Cloudflare One MDM documentation for details.
• Client Certificate device-posture checks now support template variables (e.g. ${serial_number}, ${device_uuid}) in the Subject Alternative Name field, matching what the documentation has always claimed. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry.
• The UseWebView2 registry value (HKLM\SOFTWARE\Cloudflare\CloudflareWARP\UseWebView2 = y) is once again honored by the new GUI for authentication, so administrators who prefer the embedded WebView2 browser for sign-in can opt back in. This setting was effectively ignored in the previous release; the default browser was always used. This key is now also honored for re-authentications.
• Fixed a crash in the authentication browser when navigating to a site that prompts for browser permissions (microphone, camera, notifications, etc.). The same fix had previously landed for the captive-portal browser; this extends it to the auth browser.
• Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests.

Known issues

• An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed.
• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
• Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.
• Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option.
• DNS resolution may be broken when the following conditions are all true:
  • The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while the client is connected.
    To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface.

当您通过 MCP 服务器门户连接第三方 MCP 服务器时，您无法控制服务器作者如何命名工具或编写描述。不明确的名称使 AI 代理更难选择正确的工具，也使用户更难理解可用内容。

您现在可以直接在门户上重命名工具和提示词并重写其描述，而无需修改上游服务器。例如，名为 super_cool_tool 的工具可以变成 search_customer_records，并配有专门针对您组织定制的描述。

修改后的工具会在工具列表中显示 **Modified（已修改）**标签，以便管理员一眼就能看出哪些工具被自定义过。

别名会覆盖 MCP 客户端接收到的元数据。您可以在两个层级设置它们：

• 针对每个门户：仅在特定门户内适用。优先级高于服务器级别的别名。
• 针对每个服务器：适用于所有使用该服务器的门户。

您可以随时重置别名以恢复原始的上游名称。

欲了解更多信息，请参阅工具和提示词别名。

Cloudflare Mesh 仪表板现在显示高可用性节点的单副本详情。您可以查看哪个副本是活动状态，查看每个副本的 Mesh IP 和连接详情，并手动触发故障转移——这一切都可以从节点详情页面完成。

• 节点详情页面上的副本选项卡——在副本之间切换以查看每个副本的 Mesh IP、边缘数据中心、源站 IP、平台、版本和运行时间。
• 活动/备用（Active/passive）徽章，用于识别当前正在路由流量的副本。
• 手动故障转移——只需单击一下即可将备用副本提升为活动状态。先前的活动副本将切换为备用（standby）状态。
• 概览表中的 HA 徽章，用于识别运行多个副本的节点。
• 概览表中显示的活动副本 IP——仪表板现在会解析出哪个副本处于活动状态并显示正确的 Mesh IP。

要手动提升备用副本：

1. 在 Cloudflare 仪表板 ↗中，前往 Networking（网络） > Mesh。
2. 选择启用了 HA 的节点。
3. 选择备用副本选项卡。
4. 选择 Promote to active（提升为活动） 并确认。

流量会立即重定向到提升后的副本。有关故障转移行为的详情，请参阅高可用性。

支持正则表达式的 Cloudflare Gateway 策略选择器现在可以在仪表板中使用自然语言编写。当使用基于正则表达式的选择器（例如 matches regex）构建策略时，您可以用简明英语描述您想要匹配的内容，Cloudflare Agent 将生成并验证相应的正则表达式。

要开始使用，请在 Gateway 策略构建器中选择兼容正则表达式的选择器，然后选择该图标。您将看到一个用于输入自然语言的字段，例如“以 /api/v1 开头的任何 URL”或“主机中包含 gooogle 的 .com、.net 和 .app 主机”。

您还可以使用该工具来解释现有的正则表达式。如果策略中已包含正则表达式模式，您可以立即生成通俗易懂的语言描述。

内置的反馈机制允许您对每次交互进行评分，以帮助随着时间推移提高输出质量。

有关更多信息，请参阅 Cloudflare One 防火墙策略，并期待很快在数据防泄露（DLP）配置文件中支持相同的功能。

从 cloudflared 版本 2026.5.2 ↗ 开始，Cloudflare Tunnel 直接在二进制文件内部自动执行整个连接性预检查工作流程。以前，客户必须安装 dig 和 netcat 并手动运行这些命令来验证其环境。现在 cloudflared 在启动时以原生方式执行此操作 — 并在某些内容被阻止时提供可操作的修正提示。

在每次运行 cloudflared tunnel run（以及 cloudflared tunnel diag）时，二进制文件现在都会原生检查：

• DNS 解析 — region1.v2.argotunnel.com 和 region2.v2.argotunnel.com 解析为有效的 Cloudflare IP。
• 传输连接性 — 端口 7844 上的出站 UDP (QUIC) 和 TCP (HTTP/2)。
• Management API — 发往 api.cloudflare.com 的出站 TCP/443，用于软件更新。

结果将以可扫描的 CLI 表格形式打印，包含以下三种状态：

• ✅ 通过 — 检查成功。
• ⚠️ 警告 — 非阻塞问题，例如 Management API 无法访问，因此自动更新将无法工作，但 Tunnel 仍会启动。
• ❌ 失败 — 阻塞问题，并附有具体的修正提示（例如 Allow outbound UDP on port 7844）。

如果 DNS 无法解析，或者端口 7844 上的 UDP 和 TCP 双双失败，cloudflared 将提前退出并报告失败，而不是在不透明的 failed to dial 错误中循环。

现在每次启动都会自动运行预检查，这还能捕获诸如通宵防火墙策略变更之类的问题退化 — 无需记得重新运行故障排除指南。

要获取这一新行为，请将 cloudflared 升级到版本 2026.5.2 或更高版本。欲了解更多细节，请参阅连接性预检查文档。

A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page.

This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:

• Right click context menu to access the most common client actions quickly
• Built-in captive portal login experience

Additional Changes and improvements

• Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file.
• Fixed a proxy mode connection stall issue.

Known issues

• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
• Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.

A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page.

This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:

• Right click context menu to access the most common client actions quickly
• Built-in captive portal login experience

Additional Changes and improvements

• Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file.
• Fixed a proxy mode connection stall issue.

Known issues

• Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process.
• An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed.
• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
• Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.
• Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option.
• DNS resolution may be broken when the following conditions are all true:
  • The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while the client is connected.
    To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface.

A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page.

This release introduces the new Cloudflare One Client UI for Linux! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:

• Right click context menu to access the most common client actions quickly
• Built-in captive portal login experience

Changes and improvements

• Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file.
• Official support for RHEL 9 has been added for Cloudflare Mesh nodes. To install the RHEL 9 package, the Extra Packages for Enterprise Linux (EPEL) repository must be active, as it contains dependencies required for the tray icon and captive portal webview.
• Fixed a proxy mode connection stall issue.

Known issues

• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
• Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.

您现在可以将 Cloudflare 权限范围限定为单个 Cloudflare Tunnel 实例和 Cloudflare Mesh 节点。管理员可以委派对特定 Tunnel 或 Mesh 节点的访问权限，而无需授予对整个账户中私有网络的控制权。

当您添加成员或创建权限策略时，资源选择器现在将 Cloudflare Tunnel 实例和 Cloudflare Mesh 节点列为可限定范围的资源类型。您可以：

• 向支持操作人员授予对单个 Cloudflare Tunnel 实例的只读角色，以进行日志流传输和诊断，而不会暴露其他 Tunnel 或允许破坏性操作。
• 向应用程序团队授予对特定 Cloudflare Mesh 节点的写入角色，而无需让他们访问私有网络的其余部分。
• 将单个策略的范围同时限定为一个或多个 Tunnel 以及 Mesh 节点。

细粒度权限是与现有账户级别角色平行的层，它们不会取代后者。

• 现现的账户级别角色继续有效。 拥有 Cloudflare Access 或 Cloudflare Zero Trust 的成员将保留对账户中每个 Tunnel 和 Mesh 节点的写入访问权限。这确保了与现有自动化和令牌的向后兼容性。
• 细粒度权限是累加的。 对于针对特定 Tunnel 或 Mesh 节点的任何 API 请求，如果主体具有账户级别角色或该资源的细粒度权限，则将授予访问权限。
• 资源枚举是感知授权的。 列表端点（GET /accounts/{id}/cfd_tunnel，GET /accounts/{id}/warp_connector）仅返回主体至少具有只读访问权限的资源。

• 配置 Cloudflare Tunnel 的细粒度权限。
• 配置 Cloudflare One 中 Cloudflare Tunnel 和 Cloudflare Mesh 的细粒度权限。
• 查看 Cloudflare 角色参考上的资源范围角色。

Cloudflare Access 现在支持将 Cloudflare 本身用作身份提供商。如果您发布了 Access 应用程序并选择 Cloudflare 作为登录方法，用户可以使用其现有的 Cloudflare 账户登录——无需一次性 PIN，无需第三方 IdP 配置，也无需共享电子邮件收件箱。身份验证由 Cloudflare 自身的账户安全性（包括多因素身份验证）提供支持，因此在大多数用例中，它比基于 OTP 的登录更易于设置且更安全。

Cloudflare 现在是所有新创建的 Zero Trust 账户的默认身份提供商，取代了一次性 PIN（One-time PIN）。

这还启用了两个新功能：

• Cloudflare 账户成员选择器（Cloudflare Account Member selector） — 一种新的策略选择器，根据用户在 Cloudflare 账户中的成员资格来进行匹配。您可以针对当前账户，也可以为跨账户访问场景指定不同的账户 ID。
• Restrict to account members（限制为账户成员） — 一种身份提供商配置选项，将身份验证限制为属于您 Cloudflare 账户成员的用户。

要开始使用，请在您的 Zero Trust 设置中将 Cloudflare 添加为身份提供商。

Cloudflare CASB 现已与 Claude Compliance API ↗ 集成。此增强功能为安全团队提供了对其组织内 Claude 使用模式、管理员活动和合规相关事件的可见性。

Claude Compliance API 提供对 Claude Enterprise 和 Claude Platform 内审计日志及管理操作的结构化访问。Cloudflare CASB 摄取这些数据，以呈现帮助组织增强安全态势并执行 AI 治理的安全发现结果。

从今日起，安全团队可以扫描以下资产的安全发现结果：

• 公开项目 — 设置为公开可见性的项目
• 项目附件 — 添加到项目中违反 DLP 策略的文件和文档
• 聊天文件 — 违反 DLP 策略的用户上传和提供商生成的文件
• 聊天消息 — 违反 DLP 策略的用户提示和提供商响应
• Artifacts — 违反 DLP 策略的提供商生成的文档和文件

此集成向所有 Cloudflare One 客户开放。新 Cloudflare 客户可以注册并免费开始使用前两个集成。现有客户可直接在仪表板中启用集成。集成在启用后立即开始扫描，并在几分钟内在仪表板中呈现发现结果。

使用 Unified Routing 模式的账户现在已完全支持 Network Analytics。通过 Unified Routing onramp 和 offramp 的流量现在可以在 Network Analytics 中可见，其维度和过滤器与标准数据平面上的流量相同。

这弥补了已将隧道迁移到 Unified Routing 但在 Network Analytics 仪表板中失去对其数据平面流量可视性的客户的功能差距。无需更改配置——所有启用了 Unified Routing 的账户都会自动收集分析数据。

有关其余的 Beta 限制，请参阅流量引导 Beta 限制。

Access 登录页面和一次性密码 (OTP) 页面现在采用全新设计，提高了视觉一致性、用户信任度和移动端自适应性。

更新前：

更新后：

更新后的登录体验包括：

• 统一的身份验证卡 - 所有登录选项（身份提供商按钮、电子邮件输入、OTP）现在都显示在具有一致样式的单个卡片中，取代了先前的多部分布局。
• 一致的按钮样式 - 身份提供商按钮使用统一的大小和布局，以便于快速浏览和选择。
• 更好的移动端体验 - 自适应布局的改进确保登录页面在手机和平板电脑上正确渲染。
• 支持深色模式 - 登录页面现在支持深色模式。

默认情况下，现在为新的 Magic Transit 和 Cloudflare WAN 账户分配单个 IPv4 Anycast 地址。

Cloudflare 会通过从全球许多分布式数据中心内的多个节点广播您的端点 IP，从而自动处理其网络上的故障。要处理您网络上的故障，请从不同的路由器配置两个隧道。

如需为您的账户申请额外的 Anycast IP 地址，请联系您的账户团队。

有关隧道配置指南，请参阅 Cloudflare WAN 的配置隧道端点或 Magic Transit 的配置隧道端点。

Cloudflare Gateway 现在支持针对 DNS、HTTP 和 网络防火墙策略使用自然语言创建策略。管理员可以用纯文本描述他们想要的结果，Cloudflare 将生成一个完整的策略规则来填充策略生成器表单。

要使用自然语言创建策略，请在任何 Gateway 防火墙策略选项卡上选择 Create with AI（使用 AI 创建）。选择策略类型，描述该策略应执行的操作，随后一个完整配置的规则将显示在策略生成器中以供审查。您可以在保存之前编辑任何字段，或使用不同的提示词重新生成。

生成的策略结合了您的账户上下文（包括列表、DLP 配置文件、应用和设备状态检查），从而自动解析对现有资源的引用。

内置的反馈机制允许您对每个生成的策略进行评分并提供可选评论，Cloudflare 会使用这些评论来不断改进输出质量。

有关更多信息，请参阅 Gateway 防火墙策略。

A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page.

This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:

• Right click context menu to access the most common client actions quickly
• Built-in captive portal login experience

Additional Changes and improvements

• Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file.

Known issues

• Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process.
• An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed.
• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
• Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.
• Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option.
• DNS resolution may be broken when the following conditions are all true:
  • The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode.
  • A custom DNS server address is configured on the primary network adapter.
  • The custom DNS server address on the primary network adapter is changed while the client is connected.
    To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface.

A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page.

This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate:

• Right click context menu to access the most common client actions quickly
• Built-in captive portal login experience

Additional Changes and improvements

• Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file.

Known issues

• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.
• Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release.