Products · Cloudflare One
Cloudflare One
Replace legacy security perimeters with Cloudflare's network to protect your organization
Pricing and limits
Cloudflare's docs have no pricing or limits page for Cloudflare One. Its pricing comes with Cloudflare's plans.
Timeline
November 2026
- Cloudflare Gateway DNS-over-TLS Connectivity Issues over IPv4 Incident
Minor impact. Resolved Nov 3, 2026, 00:34 UTC.
- Organize and authorize Access service tokens with tags
You can now assign key-value tags to Access service tokens and use those tags to organize credentials or control application access. Each token supports up to five tags, such as environment: production or team: payments. Add or edit tags when you create or update a token in the dashboard or service token API. You can search and filter by tag on the Service Tokens page. Tags also appear in Resourc…
October 2026
- Inspect provisioned users and groups with the SCIM population viewer
The SCIM population viewer lets you inspect the users and groups provisioned to Cloudflare One by each identity provider. You can check which resources Cloudflare has received without making API requests or opening a support ticket. In Zero Trust > Integrations > Identity providers, select a user or group count in SCIM resources to open the viewer. You can: Search users by username, email, name,…
- Cloudflare WAN supports regional Gateway HTTP inspection
Cloudflare WAN traffic can now use a Gateway processing region with Regional Services. HTTPS traffic enters a Cloudflare data center (that may be outside the selected region) via an IPsec or GRE tunnel, or through Direct CNI, and remains encrypted until Gateway forwards it to the selected region for TLS decryption and HTTP inspection. This feature gives organizations control over where their sens…
- Filter MCP tool-call analytics by response status
MCP tool-call analytics support a response_status query parameter on the account, portal, and server timeseries endpoints. Use success, error, or cached to count one status, or all to include every status. The default is success. Previously, counts included failed and cached calls. If you need the previous all-status counts, set response_status=all explicitly: GET /accounts/{account_id}/access/ai…
- Google Workspace SCIM user provisioning through generic SAML
System for Cross-domain Identity Management (SCIM) is an open standard that synchronizes user identities between an identity provider and a service. For more information, refer to SCIM provisioning. Google Workspace is rolling out custom SCIM profiles in beta. Organizations with access to the feature can use Google's built-in provisioning service to send user updates and deprovisioning events to…
- Fully customize user-facing Access pages
Cloudflare Access now supports HTML and Liquid templates for login, identity-denied, forbidden, and command-line approval pages. Custom templates allow you to control the branding and appearance of each supported page. Liquid variables allow you to provide custom instructions to users or provide a clear reason why they were blocked. Create templates in the Cloudflare One dashboard, validate them…
- Bringing post-quantum cryptography to geographically fenced key management Blog
Cloudflare's new post-quantum GeoKey Manager protects geographically fenced decryption keys from harvest now, decrypt later attacks. Learn how we redesigned our cryptography stack to support strict data sovereignty in a post-quantum world.
- Cloudflare One Client for Windows (version 2026.9.1555.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page. This release includes the following highlights: Added automatic endpoint selection for Global Acceleration. When Global Acceleration is enabled for an organization, the client connects to the Global Acceleration endpoints while the device is in the acceleration region and to the standard…
- Cloudflare One Client for macOS (version 2026.9.1555.1)
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page. This release includes the following highlights: macOS 15.0 is now the minimum supported version. This release does not run on macOS 14. Added automatic endpoint selection for Global Acceleration. When Global Acceleration is enabled for an organization, the client connects to the Global Acc…
- Cloudflare Tunnel supports URL normalization
Starting from version 2026.10.0, Cloudflare Tunnel can normalize URLs before matching ingress rules. This improves security for tunnels with rules that require Cloudflare Access validation. The URL path sent to your origin stays the same. In three months, starting 2027-01-25, new cloudflared releases will turn on URL normalization by default. Test your path-based routing before that date, as this…
- Granular Tunnel Read And Monitor role is generally available
The Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is now generally available. You can grant a member read access and log streaming for specific Cloudflare Tunnel instances without granting write access or access to every Tunnel in your account. This role includes the same access as Cloudflare Tunnel - Granular Connector cloudflared Read: viewing selected Tunnels, their…
- Cloudflare One Client for Windows (version 2026.7.1384.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
- Cloudflare One Client for macOS (version 2026.7.1384.0)
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
- Cloudflare One Client for Windows (version 2026.8.2115.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
- Cloudflare One Client for macOS (version 2026.8.2115.0)
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
- Cloudflare One Client for Linux (version 2026.8.2115.0)
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an issue building trusted certificate chains.
- Cloudflare Secure Web Gateway and DLP enforcement issues for Google Gemini Incident
Minor impact. Resolved Oct 20, 2026, 22:46 UTC.
- 50,000 routes per account and Tunnels for Platforms
Two changes make it easier to run Cloudflare Tunnel at scale. 50,000 routes per account by default The default limit for routes is now 50,000 per account, up from 1,000. This limit covers CIDR routes and hostname routes for Cloudflare Tunnel and Cloudflare Mesh. The new limit applies to every account automatically, with no action required. Published applications (public hostnames) are not routes…
- A fully programmable secure web gateway Blog
Cloudflare Gateway and Data Loss Prevention have inherited the flexibility and power of Cloudflare Workers through our full-stack integration with the Cloudflare Developer platform.
- Application Library now supports custom applications
Starting today, you can create custom applications in the Application Library and reference them in Gateway DNS, Network, and HTTP policies. You can define an application with hostnames, IP subnets, or both. Then, optionally add TCP or UDP ports or port ranges to restrict HTTP and Network matching. This release also improves search and filtering in the Application Library, updates the interfaces,…
- Validate data loss prevention matches with Cloudflare Workers
Data loss prevention (DLP) custom pattern entries can use Cloudflare Workers in your account to validate matches with organization-specific logic. Your Worker can adjust a match's confidence or reject the match. For setup steps and the Worker contract, refer to Validate data loss prevention matches with Cloudflare Workers.
- BGP route filtering for IPsec and GRE tunnels
Cloudflare WAN and Magic Transit IPsec and GRE tunnels now support BGP import and export filtering. Create reusable filter profiles that specify an allow or deny action and a list of Classless Inter-Domain Routing (CIDR) targets with exact, more-specific, or prefix-length matching. Each tunnel supports one import filter and one export filter. You can create and assign profiles through the dashboa…
- Gateway and Workers integration is now in public beta
Cloudflare Gateway now integrates with Cloudflare Workers in public beta on all Zero Trust plans. You can use the Forward action in Gateway HTTP policies to run your own code on matching, permitted traffic without managing a separate proxy. The Forward action lets you transform HTTP requests and responses, return a coaching page, or run background tasks such as Slack notifications and R2 captures…
- Account context in Access deny redirects
App-aware Cloudflare Access deny redirects include an account_id query parameter when account context is available. Custom block pages can use it to identify the account that owns the application represented by kid. For example, a custom redirect can include: https://denied.example.com/?kid=<APP_AUD>&account_id=<ACCOUNT_ID>&original_url=app.example.com%2Fadmin The account ID helps block-page inte…
- Infrastructure applications support a configurable session duration
Infrastructure applications now have a configurable session duration with a default value of 24 hours. You can set the session duration when creating or editing an infrastructure application in the dashboard or via the API. When the session duration elapses, any active SSH connections through that application will be closed, and users will need to reconnect. Previously, infrastructure application…
- Request Gateway DNS64 through DNS locations and EDNS
You can now request DNS64 through Cloudflare Gateway DNS location settings or Extension Mechanisms for DNS (EDNS) options. DNS64 synthesizes AAAA records from A records for IPv6-only networks. These networks require network address translation from IPv6 to IPv4 (NAT64). Turn on Enable DNS64 for a location, or include an empty EDNS option 65051 in individual queries. Both mechanisms support UDP, T…
- Cloudflare One Client for Windows (version 2026.8.2110.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page. This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply.
- Cloudflare One Client for macOS (version 2026.8.2110.0)
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page. This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply.
- Cloudflare One Client for Linux (version 2026.8.2110.0)
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page. This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply.
- Unified dashboard navigation for Zero Trust
The Cloudflare dashboard now combines Zero Trust and main dashboard navigation. You can move between Cloudflare products from the same navigation. All customers can browse Zero Trust products from the primary navigation. Zero Trust customers can also access other services from this navigation. These include the developer platform, account memberships, and resource tagging. As part of this change,…
- Cloudflare One Client for macOS (version 2026.8.2100.0)
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page. This release includes the following highlights: Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across reconnects. Support for routing non-RFC 1918 local IPv4…
- Cloudflare One Client for Windows (version 2026.8.2100.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page. This release includes the following highlights: Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across tunnel reconnections. Support for routing non-RFC 191…
- Cloudflare One Client for Linux (version 2026.8.2100.0)
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page. This release includes the following highlights: Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across reconnects. Support for routing non-RFC 1918 local IPv4…
- Create CASB integrations with Terraform
You can now create Cloudflare CASB integrations using the Cloudflare Terraform provider. This lets you manage supported integrations alongside your other infrastructure-as-code. The following example creates a Google Cloud Platform integration: resource "cloudflare_zero_trust_casb_integration" "google_cloud_platform" { account_id = var.cloudflare_account_id name = "Google Cloud Platform" paused =…
- Cloudflare Organizations is generally available
Cloudflare Organizations is now generally available for Enterprise customers and MSSP/Distributor partners. Organizations provides a top-level container for centrally managing accounts, members, analytics, and shared policies. Organization Super Administrators receive implicit access to every account in their Organization without requiring separate account memberships. Enterprise customers can ma…
- Detect organization-specific risks with CASB custom finding types
Cloudflare CASB now supports custom finding types, giving security teams full control over the security conditions CASB detects across their SaaS and cloud integrations. In addition to CASB's library of standard finding types, you can now write your own detection logic using Rego ↗︎, the open-source policy language from Open Policy Agent (OPA). Use custom finding types to match your organization'…
- BGP over IPsec and GRE tunnels generally available
BGP peering over IPsec and GRE tunnels is generally available for Cloudflare WAN and Magic Transit. You can use it for production workloads. BGP peering exchanges routes dynamically between your devices and your Cloudflare virtual network routing table. You no longer need to update static routes manually as your network changes. BGP over IPsec and GRE tunnels is available to all accounts that use…
- New strict service token authentication setting for Access
The strict service token authentication setting applies consistent behavior to requests made with service tokens. When the setting is on for a Zero Trust organization, Access handles requests with service token headers as follows: If authentication or authorization fails, Access always returns 401 or 403 instead of redirecting the client to the login page with 302. Only Service Auth policies can…
- Simplified permissions for tagging targets with Access for Infrastructure
You can now tag targets using only the Zero Trust Write API token permission. Previously, tagging targets through the API required both Zero Trust Write and Tag Write permissions on the API token. This change applies to inline target tagging through the Infrastructure Access Targets API. Tagging resources through the general Resource Tagging API still requires the Tag Admin, Tag Write, or equival…
September 2026
- Cloudflare One Client for Windows (version 2026.8.2033.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page. This beta release includes the following changes and improvements: Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. Improved reauthentication reliability and fixed an issue where a reauthentication could f…
- Role-based access control for Browser Isolation policies
Isolation policies support role-based access control (RBAC). Because isolation policies are Gateway HTTP policies with the Isolate action, Gateway's account-level and resource-scoped roles apply to them directly. Use the Zero Trust HTTP Policies Admin account-level role to grant access to all HTTP policies in the account. You can also assign a resource-scoped role to let a team member manage a sp…
- Cloudflare One Client for Windows (version 2026.8.2028.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page. This beta release includes the following changes and improvements: Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. Improved reauthentication reliability and fixed an issue where a reauthentication could f…
- Cloudflare One Client for macOS (version 2026.8.2028.1)
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page. This beta release includes the following changes and improvements: Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. Improved reauthentication reliability and fixed an issue where a reauthentication could for…
- Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs
You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and cloudflared replica received each session. Gateway network logs and Zero Trust Network Session Logs now identify two new kinds of traffic: Mesh — Traffic sent from or delivered to a Cloudflare…
- MCP server portals are now generally available
MCP server portals are now generally available to all Cloudflare customers. A portal gives users one endpoint for approved Model Context Protocol (MCP) servers. Cloudflare Access logs tool, prompt, and resource activity. Since the open beta, MCP server portals have added: Gateway routing for HTTP logging and data loss prevention (DLP) scanning Code Mode policies that control how portals reduce to…
- Authentication options for Google Workspace identity providers
Google Workspace identity provider integrations now include prompt controls and device-scoped login hints in the Cloudflare dashboard and API. Choose Google's default behavior, silent authentication, consent, or account selection. If silent authentication cannot use an active Google session, Access retries once with Google's default interactive flow. Access can also send a domain-matched login hi…
- Traffic Destination selector in Gateway policies
Gateway HTTP and Network policies now include a Traffic Destination selector that identifies how traffic exits Cloudflare. This allows administrators to write policies that target specific off-ramp methods - for example, applying different rules to traffic destined for the public Internet compared to traffic routed through Cloudflare Tunnel or Cloudflare WAN. Available traffic destination values…
- Add Mesh participants with guided onboarding
Cloudflare Mesh now makes it faster to add and manage participants from the dashboard. Select Add participant from Networking > Mesh to deploy a Mesh node or find the information needed to connect a client device. The updated dashboard includes the following improvements: More Mesh node deployment options — Install a node on Linux, Kubernetes, Docker Compose, or Docker CLI. The dashboard provides…
- Automatically manage inactive Access service tokens
Cloudflare Access administrators can now automatically disable or delete inactive service tokens. Administrators can set an inactivity period from 30 to 365 days and choose what Access does when a token reaches that limit. To be eligible for cleanup, a token must be older than the configured period, must not have successfully authenticated during that period, and must not be directly referenced b…
- Private MCP server support for MCP server portals
MCP server portals can now connect to MCP servers available only on your private network. The portal uses Cloudflare Gateway to reach private hostnames and IP addresses without exposing the MCP server to the public Internet. Connect the server network to Cloudflare with Cloudflare Tunnel, Cloudflare Mesh, or another Cloudflare One connector. Configure a private hostname or CIDR route, then turn o…
- Cloudflare One Client for macOS (version 2026.8.1755.1)
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page. This beta release includes the following changes and improvements: Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. Improved reauthentication reliability and fixed an issue where a reauthentication could for…
- Cloudflare One Client for Windows (version 2026.8.1755.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page. This beta release includes the following changes and improvements: Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. Improved reauthentication reliability and fixed an issue where a reauthentication could f…
- Unified Routing generally available
Unified Routing is generally available for Cloudflare WAN and Magic Transit. Unified Routing improves the integration between Cloudflare One and the standard connectivity onramps supported by Cloudflare WAN. It is capable of many new features including Automatic Return Routing, BGP and custom client subnets. We recommend Unified Routing for all new accounts. For details, refer to Cloudflare WAN t…
- cloudflared to deprecate 32-bit Windows and Intel-based macOS builds in 2027
Starting in 2027, Cloudflare will deprecate 32-bit Windows and Intel-based macOS builds of cloudflared. After the deprecation takes effect, Cloudflare will no longer publish new cloudflared releases for either architecture. Windows 10, the last Windows release to support 32-bit systems, reached end of support in October 2025. Apple has also deprecated Intel-based Mac computers. macOS 26 Tahoe, re…
- Access for Infrastructure now supports tagged targets and tag-based target criteria
Access for Infrastructure now integrates with Resource Tagging. You can attach key-value tags to infrastructure targets and use them in access policies. You can manage tags on targets inline when you create or edit a target or through the central Resource Tagging API. Cloudflare keeps tags in sync across both methods. Infrastructure applications also support a target criteria model with include,…
- Require fresh authentication for SAML identity providers
Cloudflare Access can now request fresh authentication from a SAML identity provider for every login. Turn on Require reauthentication in the Cloudflare dashboard, or set force_authn to true through the API. Access will then set ForceAuthn to true in signed and unsigned SAML authentication requests. This option is useful when an application requires users to reauthenticate at the identity provide…
- Discover where sensitive data goes before you create a Data Loss Prevention policy
Passive Detection for Cloudflare Data Loss Prevention (DLP) lets you learn from your Gateway traffic before deciding what to log or block. Discover the sensitive data types in sampled traffic, explore their destinations, and use the findings to build policies around your organization's needs. The dashboard brings together detections from sampled HTTP request and response bodies. Select an entry t…
- Cloudflare One Client for macOS (version 2026.8.1290.1)
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page. This beta release includes the following changes and improvements: Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. Improved DNS reliability on networks with lower MTUs by clamping the TCP maximu…
- Cloudflare One Client for Windows (version 2026.8.1290.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page. This beta release includes the following changes and improvements: Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. Improved DNS reliability on networks with lower MTUs by clamping the TCP maxi…
- Improved iOS tap-to-type experience for Browser Isolation
Browser Isolation has improved the tap-to-type experience for users on iOS devices. Previously, Browser Isolation displayed a full-screen overlay with the message tap to type when users focused a text field. The prompt now appears inline over the focused text field, reducing disruption when users enter text in isolated sessions. If the focused text field is too small to display the full prompt, B…
- New CASB integration for Zoom
Cloudflare CASB now integrates with Zoom. The integration connects through Cloudflare's pre-built OAuth application — no manual app setup in Zoom is required. After an initial scan, CASB continuously scans your Zoom account to surface new findings as your environment changes. Zoom is widely used for meetings, webinars, and collaboration. Misconfigurations in account settings, meeting security con…
- Define custom applications for breakout and prioritized traffic from the Cloudflare One Appliance dashboard
You can now define custom applications for breakout and prioritized traffic on the Cloudflare One Appliance directly from the dashboard, without calling the API. In Traffic Steering > Breakout traffic or Prioritized traffic, select Assign application traffic > Add to create a custom application matched by Hostnames, IP subnets, and/or the new Source subnets field, alongside Cloudflare-managed app…
- Configure DHCP options from the dashboard on Cloudflare One Appliance
You can now configure custom DHCP options directly from the dashboard when the Cloudflare One Appliance is acting as the DHCP server for a LAN. In LAN configuration, under DHCP server options, select Add DHCP option to choose from common options for PXE / iPXE boot, VoIP phone provisioning, and vendor-specific configuration, or select Add custom option to enter your own option code, type, and val…
- Create multiple Cloudflare Tunnel and Cloudflare Mesh routes at once
You can now create multiple Cloudflare Tunnel and Cloudflare Mesh routes from the Routes page in a single action, instead of submitting one route at a time. When creating a route, you can now: Add multiple destinations at once — Enter a comma-separated list of CIDR ranges or hostnames to create several routes of the same type and connector together. Queue up multiple routes — Select Add another t…
August 2026
- Cloudflare One Client for macOS (version 2026.7.1376.0)
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page. This hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms.
- Cloudflare One Client for Windows (version 2026.7.1376.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page. Fixed a rare but critical issue where the client could fail to connect or switch organizations due to an invalid registration after switching installed client versions. Additionally, this hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platform…
- Cloudflare One Client for Linux (version 2026.7.1377.0)
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page. This hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms.
- Access service token secrets use a scannable format
Cloudflare Access service token Client Secrets created on or after August 26, 2026, use the format cfast_[40 alphanumeric characters][8-character checksum]. The prefix and checksum make these credentials easier for secret scanning tools to identify with fewer false positives. Existing service token secrets continue to work and do not require rotation. Both formats use the same Client ID and the s…
- Grace periods for service token rotation
Cloudflare Access administrators can now choose a grace period when rotating a service token secret. Both secrets remain valid during the grace period, giving administrators time to update services without interrupting authentication. The dashboard offers grace periods from one hour to 30 days. Administrators can also revoke the previous secret immediately. The API accepts an RFC 3339 expiration…
- Temporarily turn off Access service tokens
Cloudflare Access administrators can now temporarily turn off service tokens without deleting them. A disabled token cannot authenticate, but its configuration remains available so administrators can turn it on again later. Turning off a token also stops any previous secret in an active rotation grace period. Use this control to contain suspected credential exposure or pause an automated service.…
- MCP server portals support MCP 2026-07-28 specification
MCP server portals support the stateless MCP 2026-07-28 specification for client and upstream server connections. The portal's /mcp endpoint automatically accepts stateless MCP 2026-07-28 requests and earlier 2025 Streamable HTTP clients. When the portal connects to an upstream Streamable HTTP server, it checks for MCP 2026-07-28 support and falls back to the 2025 handshake when needed. Client an…
- Download the Cloudflare One Virtual Appliance for your hypervisor from the dashboard
When you register a Cloudflare One Virtual Appliance, you can now select your hypervisor and download the appliance directly from the dashboard — no need to look up asset URLs. On the Connectors page, select Add an appliance, choose Virtual appliance, then select your hypervisor: VMware ESXi, Proxmox, or libvirt/KVM. Download the OVA image (VMware ESXi) or the install script (Proxmox and libvirt/…
- Automatically remediate Microsoft 365 and Google Workspace findings with API-based CASB remediation policies
Cloudflare CASB is an API-based (agentless) tool that continuously scans your SaaS and cloud applications for security misconfigurations and data exposure. You can now use CASB remediation policies to automatically fix a finding or send a webhook the moment CASB detects it, without manual triage. Remediate Microsoft 365 and Google Workspace findings A policy can perform a first-party remediation…
- Test Data Loss Prevention profiles without sending traffic through Gateway
Test scan lets you check how Data Loss Prevention (DLP) evaluates sample content before you apply a profile to production traffic. Paste text, upload a file, or upload a HAR file, then select the profiles you want to test. Test scan sends content directly to the DLP scanner. Gateway policies are not evaluated, no traffic passes through Gateway, and no Gateway activity logs are created. Results in…
- Cloudflare One Client for Windows (version 2026.7.1343.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page. This release introduces multiple features from our previous beta release into stable release, including: When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication in…
- Cloudflare One Client for macOS (version 2026.7.1343.0)
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page. This release introduces multiple features from our previous beta release into stable release, including: When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication inst…
- Cloudflare One Client for Linux (version 2026.7.1343.0)
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page. This release introduces multiple features from our previous beta release into stable release, including: When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication inst…
- Access resource lists now support resource-scoped roles
Members with only resource-scoped Access roles can now open Access resource list pages in the Cloudflare dashboard and call list endpoints in the API. They no longer need an additional account-scoped read-only role to list resources. The dashboard and API return only resources included in the member's permission policy scopes. Filtering applies to Access applications, policies, service tokens, an…
- Configure origin application settings for Cloudflare Tunnel in the dashboard
You can now configure origin application settings directly in the Cloudflare dashboard when adding or editing a published application route for a Cloudflare Tunnel. These settings control how cloudflared connects to your origin server and were previously only available in the Cloudflare One dashboard or via local configuration files. When editing a published application, expand Additional applica…
- Post-quantum key exchange for MX deployments
Cloudflare Email Security now supports post-quantum hybrid key exchange with X25519MLKEM768 on the SMTP connections we make to receive and deliver mail. Deploying Email Security in front of a provider that supports post-quantum hybrid key agreement (like Google Workspace) will create a TLS 1.3 connection using post-quantum key agreement. Inbound MX connections and outbound delivery connections no…
- You can now enable Access on a Worker or all Workers at once
You now have two new ways to protect your Workers with Cloudflare Access. Protect an application across all its domains at once Until now, if a Worker was reachable on a route, a Custom Domain, and a workers.dev URL, you had to manually add each one to an Access application and keep the list in sync whenever routes or domains changed. Now, Access attaches the policy to the Worker itself, so every…
- Detect and control software package downloads with package registry security
Cloudflare Gateway can now detect software package downloads and give you policy control over supply chain traffic. When a developer or CI/CD pipeline downloads a package through Gateway, the proxy identifies the registry protocol from the request URL and extracts the package ecosystem, name, version, and namespace. You can then write HTTP policies using pkg.* selectors to allow or block package…
- Block emails by content with blocked content rules
Cloudflare Email security now lets administrators write their own content-based blocking rules. A new Blocked content area under Policies & rules lets you define a plaintext string or a regular expression, choose whether to scan the message subject, body, or both, and automatically block any message that matches. Create rules using either plaintext matches or regular expressions — useful for bloc…
- Independent MFA supports FIDO2 for infrastructure applications
Infrastructure applications support independent multi-factor authentication (MFA) with FIDO2 keys. You can allow ssh_fido2_key, piv_key, or both in application-level and policy-level MFA settings. Users enroll FIDO2 keys through the App Launcher and connect with the generated SSH identity. FIDO2 keys for SSH are separate from browser-based WebAuthn security keys and Personal Identity Verification…
- MCP protocol detection and AI Security dashboard
Cloudflare Gateway now automatically detects Model Context Protocol (MCP) ↗︎ traffic flowing through your network. MCP is the standard protocol used by AI agents to connect to external tools and data sources. Gateway identifies MCP requests by inspecting protocol-specific headers and payload characteristics. MCP policy selector A new Is MCP selector (experimental.is_mcp) is available in HTTP poli…
- Traffic Source selector in Gateway policies
Gateway HTTP and Network policies now include a Traffic Source selector that identifies how traffic reaches Cloudflare. This allows administrators to write policies that target specific on-ramp methods - for example, applying different rules to traffic arriving via the Cloudflare One Client compared to traffic routed through an MCP portal or a proxy endpoint. Available traffic source values UI na…
- Hostname routing is now generally available, with a new public IP range for initial resolved IPs
Hostname routing ↗︎ is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors: Cloudflare Tunnel: route a private hostname (for example, wiki.internal.local) to a private application behind your tunnel, or a public hostname (for example, bank.example.com) to egress through a specific tunnel and anchor tr…
- Cloudflare One Client for Windows (version 2026.6.905.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page. This hotfix addresses an uncommon and intermittent case on Windows devices where the device is unable to reconnect after the device is woken from sleep.
- Stream live logs from Cloudflare Tunnel in the dashboard
Real-time Tunnel log streaming is now available in the Cloudflare dashboard under Networking > Tunnels. This brings the same live debugging capability previously only available in the Cloudflare One dashboard, including multi-connector aggregated streaming for high-availability deployments. In the tunnel detail view, a new Live logs tab lets you: Stream logs from single or multiple connectors — I…
- Container image for Cloudflare Mesh
Cloudflare Mesh nodes can now run as Docker containers. The cloudflare/mesh ↗︎ image is available on Docker Hub for Docker Compose, Kubernetes, and any OCI-compatible runtime — no host-level package installation required. The image supports amd64 and arm64 architectures and includes built-in source NAT so return traffic routes correctly without VPC route table changes. Deployment patterns Docker…
- Identity-aware controls are now available in AI Gateway
AI Gateway now integrates with Cloudflare Access, giving you two new capabilities: Protect your gateway endpoint. Put your AI Gateway behind Access so you can set policies that control who is allowed to call a specific gateway's endpoint. Identity-aware controls. When traffic reaches AI Gateway through an Access-protected custom domain, AI Gateway can use the authenticated user's Access identity…
- Control authorization cookies for multi-domain Access applications
Cloudflare Access administrators can now control whether a self-hosted application preemptively sets authorization cookies across its public hostnames. Previously, Access automatically used eager redirects for applications with five or fewer hostnames. Applications with more than five hostnames received cookies as users visited each hostname. Administrators can now choose either behavior, regardl…
July 2026
- Cloudflare One Client for Windows (version 2026.7.1210.1)
A new Beta release for the Windows Cloudflare One Client is now available on the beta releases downloads page. This beta release includes the following changes and improvements: Improved connection reliability: the client now swaps protocol order after repeated connectivity-check failures, which helps when HTTP/3 is blocked after the QUIC handshake. Fixed issue where a certificate error could be…
- Cloudflare One Client for macOS (version 2026.7.1210.1)
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page. This beta release includes the following changes and improvements: Improved connection reliability: the client now swaps protocol order after repeated connectivity-check failures, which helps when HTTP/3 is blocked after the QUIC handshake. Fixed issue where a certificate error could be in…
- Static OAuth client credentials for MCP server portals
MCP server portals can now connect to upstream MCP servers that require a pre-registered OAuth client. This supports OAuth providers that do not offer Dynamic Client Registration or have disabled it. This unlocks portal connections to major SaaS providers such as Slack and GitHub, whose MCP servers do not yet support DCR. When adding an MCP server, administrators can enter the client ID and clien…
- Admins can turn on Code Mode by default for MCP portal users
MCP server portals now support four Code Mode policies: Off, Opt-in, On by default, and Enforced. Admins can choose whether Code Mode is unavailable, optional, enabled by default, or required for every session. Existing portals retain their current behavior. Portals that previously allowed Code Mode use Opt-in, while portals that did not allow Code Mode use Off. New portals also use Opt-in by def…