--- title: Cloudflare One Changelog image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) Cloudflare One ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) Jun 04, 2026 1. ### [Share identity providers across accounts with IdP federation](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-04-idp-federation/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) Cloudflare Access now supports [IdP federation](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/idp-federation/), which allows organizations to share a single identity provider across multiple Cloudflare accounts. Instead of configuring the same IdP (for example, Okta or Entra ID) separately in every account, you configure it once in a source account and share it with the other accounts in your organization. Each recipient account gets a read-only IdP connection that routes authentication back to the source account through a bridge — a hidden application in the source account that brokers the cross-account login. End users sign in with their existing IdP credentials, and each account's Access policies evaluate the resulting identity just like any other IdP login. Key capabilities: * **One IdP, many accounts** — Configure your IdP once and share it with all accounts in your organization. * **Lifecycle management** — As accounts join or leave your Cloudflare organization, their IdP connections are provisioned and removed automatically — no manual cleanup required. * **Immutable recipient connections** — IdP connections in recipient accounts cannot be accidentally modified or deleted. To get started, refer to [IdP federation](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/idp-federation/). Jun 03, 2026 1. ### [SAML assertion encryption for identity providers](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-03-saml-assertion-encryption/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) Cloudflare Access now supports SAML assertion encryption for identity provider integrations. When turned on, your identity provider encrypts SAML assertions using a Cloudflare-managed certificate before sending them through the user's browser. Only Access can decrypt these assertions, protecting sensitive identity data even after TLS termination. Without encryption, SAML assertions are transmitted in plaintext and could be visible to browser extensions or client-side malware. ![SAML encryption toggle in the identity provider configuration](https://edgetunnel-b2h.pages.dev/_astro/saml-encryption.J5jmiYv8_ZkhXFT.webp) SAML encryption includes built-in certificate lifecycle management: * **Automatic certificate generation**: Access generates an encryption certificate when you turn on SAML encryption for an identity provider. * **Certificate rotation**: Rotate certificates without downtime. The previous certificate remains valid until expiration, giving you time to update your IdP. * **PEM export**: Copy the certificate in PEM format for manual upload to your IdP, or point your IdP to the SAML metadata endpoint for automatic retrieval. To get started, refer to [Encrypt SAML assertions](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-saml/#encrypt-saml-assertions). Jun 02, 2026 1. ### [Cisco IOS XE](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-02-cisco-ios-xe/) [ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/) The Cisco IOS XE third-party integration guide for Cloudflare WAN has been updated to include: * Post Quantum Cryptography (PQC) * Policy-Based Routing (PBR) * IP Service Level Agreement (IP SLA) This link will take you directly to the updated [Cisco IOS XE](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/third-party/cisco-ios-xe/) guide. May 29, 2026 1. ### [Cloudflare One Client for macOS (version 2026.5.1155.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-warp-macos-beta/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: * Right click context menu to access the most common client actions quickly * Built-in captive portal login experience **Additional Changes and improvements** * The client now applies DNS search suffixes configured in your [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. * Administrators can now control which virtual networks (VNETs) are available to which users via WARP device profile settings in the Zero Trust dashboard. Previously, every VNET in the organization was visible to every device; you can now scope the VNET picker per profile so users only see the networks relevant to them. See [VNET availability](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#vnet-availability) for details. * Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. * Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. * The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. * Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization%5Fconfigs) for details. * Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field, matching what the documentation has always claimed. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. * Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks (United inflight Wi-Fi was the reported case). The browser now reliably loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser. * Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. **Known issues** * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. May 29, 2026 1. ### [Cloudflare One Client for Windows (version 2026.5.1155.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-warp-windows-beta/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: * Right click context menu to access the most common client actions quickly * Built-in captive portal login experience **Additional Changes and improvements** * The client now applies DNS search suffixes configured in your [device profile](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. * Administrators can now control which virtual networks (VNETs) are available to which users via WARP device profile settings in the Zero Trust dashboard. Previously, every VNET in the organization was visible to every device; you can now scope the VNET picker per profile so users only see the networks relevant to them. See [VNET availability](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#vnet-availability) for details. * Added mandatory authentication. When enabled via MDM, the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates, closing the visibility gap on newly deployed devices and during re-authentication. See the [announcement blog](https://blog.cloudflare.com/mandatory-authentication-mfa/) and [documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-no-auth-no-internet/) for details. * Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. * Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. * The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. * Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization%5Fconfigs) for details. * Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field, matching what the documentation has always claimed. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. * The UseWebView2 registry value (HKLM\\SOFTWARE\\Cloudflare\\CloudflareWARP\\UseWebView2 = y) is once again honored by the new GUI for authentication, so administrators who prefer the embedded WebView2 browser for sign-in can opt back in. This setting was effectively ignored in the previous release; the default browser was always used. This key is now also honored for re-authentications. * Fixed a crash in the authentication browser when navigating to a site that prompts for browser permissions (microphone, camera, notifications, etc.). The same fix had previously landed for the captive-portal browser; this extends it to the auth browser. * Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. **Known issues** * An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. * Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option. * DNS resolution may be broken when the following conditions are all true: * The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. * A custom DNS server address is configured on the primary network adapter. * The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface. May 28, 2026 1. ### [Tool and prompt aliases for MCP server portals](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-28-mcp-portal-tool-prompt-aliases/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) When you connect third-party MCP servers through [MCP server portals](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/), you have no control over how the server author named tools or wrote descriptions. Unclear names make it harder for AI agents to select the right tool and harder for users to understand what is available. You can now [rename tools and prompts](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/#rename-tools-and-prompts-with-aliases) and rewrite their descriptions directly on the portal, without modifying the upstream server. For example, a tool named `super_cool_tool` can become `search_customer_records` with a description tailored to your organization. ![Edit tool modal showing name and description fields for an MCP server tool](https://edgetunnel-b2h.pages.dev/_astro/portal-edit-tool-modal.DrxORhBl_Z1NtRnj.webp) Modified tools display a **Modified** label in the tools list so administrators can see which tools have been customized at a glance. ![Tools authorized list showing a modified label on a renamed tool](https://edgetunnel-b2h.pages.dev/_astro/portal-tools-authorized-modified.B674Xvip_12xxcK.webp) Aliases override the metadata that MCP clients receive. You can set them at two levels: * **Per portal**: Applies only within a specific portal. Takes precedence over server-level aliases. * **Per server**: Applies across all portals that use the server. You can reset an alias at any time to restore the original upstream name. For more information, refer to [Tool and prompt aliases](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/#rename-tools-and-prompts-with-aliases). May 28, 2026 1. ### [High availability replica management for Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-28-mesh-ha-replica-ui/) [ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/) The [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) dashboard now shows per-replica details for [high availability](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/high-availability/) nodes. You can see which replica is active, view each replica's Mesh IP and connection details, and manually trigger failover — all from the node detail page. ![Mesh HA replica tabs showing active and passive replicas with per-replica Mesh IPs and a manual failover option](https://edgetunnel-b2h.pages.dev/_astro/mesh-ha-replicas.Dvf1GMmQ_Z2i6nGi.webp) #### What's new * **Replica tabs** on the node detail page — switch between replicas to see each one's Mesh IP, edge data center, origin IP, platform, version, and uptime. * **Active/passive badges** identify which replica is currently routing traffic. * **Manual failover** — promote a passive replica to active with a single click. The previous active replica switches to standby. * **HA badge** in the overview table identifies nodes running multiple replicas. * **Active replica IP** shown in the overview table — the dashboard now resolves which replica is active and displays the correct Mesh IP. #### Manual failover To manually promote a passive replica: 1. In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/?to=/:account/mesh), go to **Networking** \> **Mesh**. 2. Select an HA-enabled node. 3. Select the passive replica tab. 4. Select **Promote to active** and confirm. Traffic reroutes to the promoted replica immediately. Refer to [High availability](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/high-availability/) for details on failover behavior. May 27, 2026 1. ### [Write regex using natural language in Cloudflare One](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-27-cloudy-regex-assistance/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) policy selectors which support regular expressions can now be authored in the dashboard using natural language. When building a [policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/expression-syntax/) with a regex-based selector (like `matches regex`), you can describe what you want to match in plain English and the Cloudflare Agent will generate and validate a corresponding regular expression. ![Write policy regex using natural language](https://edgetunnel-b2h.pages.dev/_astro/gateway-regex-ai-generation.CtJ0S6FS_Z1WVe4K.webp) To get started, select a regex-compatible selector in the [Gateway policy builder](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) and select the icon. You'll see an input field for natural language, such as "any URL starting with /api/v1" or ".com, .net, and .app hosts which contain `gooogle` in the host." You can also use the tool to explain existing regular expressions. If a policy already contains a regex pattern, you can instantly generate a plain-language description. A built-in feedback mechanism allows you to rate each interaction to help improve output quality over time. For more information, refer to [Cloudflare One firewall policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) and expect to see the same functionality supported soon in [Data loss prevention profiles](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/). May 27, 2026 1. ### [Cloudflare Tunnel now runs connectivity pre-checks at startup](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-27-cloudflared-connectivity-prechecks/) [ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) Starting with [cloudflared version 2026.5.2 ↗](https://github.com/cloudflare/cloudflared/releases), [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) automates the entire [connectivity pre-checks workflow](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/) directly inside the binary. Previously, customers had to install `dig` and `netcat` and run those commands by hand to verify their environment. Now `cloudflared` does it natively at startup — and surfaces actionable remediation when something is blocked. ![cloudflared connectivity pre-checks output](https://edgetunnel-b2h.pages.dev/_astro/cloudflared-connectivity-prechecks.DRwN6tGe_c1XGu.webp) On every `cloudflared tunnel run` (and `cloudflared tunnel diag`), the binary now natively checks: * **DNS resolution** — `region1.v2.argotunnel.com` and `region2.v2.argotunnel.com` resolve to valid Cloudflare IPs. * **Transport connectivity** — outbound `UDP (QUIC)` and `TCP (HTTP/2)` on port `7844`. * **Management API** — outbound `TCP/443` to `api.cloudflare.com` for software updates. Results are printed in a scannable CLI table with three states: * ✅ **Pass** — the check succeeded. * ⚠️ **Warn** — a non-blocking issue, for example the Management API is unreachable so automatic updates will not work, but the tunnel will still come up. * ❌ **Fail** — a blocking issue, with a specific remediation hint (for example, `Allow outbound UDP on port 7844`). If DNS is unresolvable, or **both** UDP and TCP fail on port 7844, `cloudflared` exits early with the failure rather than looping on opaque `failed to dial` errors. Pre-checks now run automatically on every start, which also catches regressions like overnight firewall policy changes — no need to remember to rerun the troubleshooting guide. To get the new behavior, upgrade `cloudflared` to version `2026.5.2` or later. For more details, refer to the [Connectivity pre-checks documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/). May 26, 2026 1. ### [Cloudflare One Client for macOS (version 2026.4.1390.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-26-warp-macos-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: * Right click context menu to access the most common client actions quickly * Built-in captive portal login experience **Additional Changes and improvements** * Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. * Fixed a proxy mode connection stall issue. **Known issues** * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. May 26, 2026 1. ### [Cloudflare One Client for Windows (version 2026.4.1390.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-26-warp-windows-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: * Right click context menu to access the most common client actions quickly * Built-in captive portal login experience **Additional Changes and improvements** * Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. * Fixed a proxy mode connection stall issue. **Known issues** * Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process. * An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. * Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option. * DNS resolution may be broken when the following conditions are all true: * The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. * A custom DNS server address is configured on the primary network adapter. * The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface. May 26, 2026 1. ### [Cloudflare One Client for Linux (version 2026.4.1390.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-26-warp-linux-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Linux! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: * Right click context menu to access the most common client actions quickly * Built-in captive portal login experience **Changes and improvements** * Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. * Official support for RHEL 9 has been added for Cloudflare Mesh nodes. To install the RHEL 9 package, the Extra Packages for Enterprise Linux (EPEL) repository must be active, as it contains dependencies required for the tray icon and captive portal webview. * Fixed a proxy mode connection stall issue. **Known issues** * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. May 21, 2026 1. ### [Granular permissions for Cloudflare Tunnel and Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-tunnel-mesh-granular-permissions/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) You can now scope Cloudflare permissions to individual [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking. #### What is new When you [add a member](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/manage/) or create a [permission policy](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/), the resource picker now lists [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes as scopable resource types. You can: * Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions. * Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network. * Scope a single policy to one or many Tunnels and Mesh nodes at once. #### How it works Granular permissions are a parallel layer to existing account-level roles — they do not replace them. * **Existing account-level roles continue to work.** A member with `Cloudflare Access` or `Cloudflare Zero Trust` retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens. * **Granular permissions are additive.** For any API request on a specific Tunnel or Mesh node, access is granted if the principal has **either** the account-level role **or** a granular permission for that resource. * **Resource enumeration is authorization-aware.** Listing endpoints (`GET /accounts/{id}/cfd_tunnel`, `GET /accounts/{id}/warp_connector`) return only the resources the principal has at least read access to. #### Get started * Configure [granular permissions for Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/advanced/granular-permissions/). * Configure [granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/granular-permissions/). * Review the [resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference. May 19, 2026 1. ### [Cloudflare as identity provider and account membership selector](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-19-cloudflare-as-identity-provider/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) Cloudflare Access now supports using Cloudflare itself as an [identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/cloudflare/). If you publish an Access application and select Cloudflare as the login method, users can sign in with their existing Cloudflare account — no one-time PINs, no third-party IdP configuration, and no shared email inboxes. Authentication is backed by Cloudflare's own account security (including multi-factor authentication), making it both simpler to set up and more secure than OTP-based login for most use cases. Cloudflare is now the **default identity provider for all newly created Zero Trust accounts**, replacing One-time PIN. This also enables two new capabilities: * **Cloudflare Account Member selector** — A new [policy selector](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/#cloudflare-access-selectors) that matches users based on their membership in a Cloudflare account. You can target the current account or specify a different account ID for cross-account access scenarios. * **Restrict to account members** — An identity provider configuration option that limits authentication to users who are members of your Cloudflare account. To get started, add Cloudflare as an [identity provider](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/cloudflare/) in your Zero Trust settings. May 19, 2026 1. ### [CASB adds support for Claude Compliance API](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-19-casb-claude-compliance-api/) [ CASB ](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/) [Cloudflare CASB](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/anthropic/) now integrates with the [Claude Compliance API ↗](https://support.claude.com/en/articles/13015708-access-the-compliance-api). This enhancement gives security teams visibility into Claude usage patterns, admin activity, and compliance-relevant events across their organization. The Claude Compliance API provides structured access to audit logs and administrative actions within Claude Enterprise and Claude Platform. Cloudflare CASB ingests this data to surface security findings that help organizations enhance their security posture and enforce AI governance. #### Key capabilities Starting today, security teams can scan for security findings across the following assets: * **Public projects** — Projects set to public visibility * **Project attachment** — Files and documents added to projects that violate DLP policies * **Chat files** — User-uploaded and provider-generated files that violate DLP policies * **Chat messages** — User prompts and provider responses that violate DLP policies * **Artifacts** — Provider-generated documents and files that violate DLP policies #### Learn more This [integration](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/anthropic/) is available to all Cloudflare One customers. New Cloudflare customers can sign up and start with their first two integrations for free. Existing customers can enable the integration directly in the dashboard. The integration begins scanning immediately and surfaces findings in the dashboard within minutes. May 18, 2026 1. ### [Network Analytics support for Unified Routing](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-18-unified-routing-network-analytics/) [ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Magic Transit ](https://edgetunnel-b2h.pages.dev/magic-transit/) [Network Analytics](https://edgetunnel-b2h.pages.dev/analytics/network-analytics/) is now fully supported for accounts using [Unified Routing](https://edgetunnel-b2h.pages.dev/cloudflare-wan/reference/traffic-steering/#unified-routing-mode-beta) mode. Traffic that traverses Unified Routing onramps and offramps is now visible in Network Analytics with the same dimensions and filters as traffic on the standard data plane. This closes a parity gap for customers who had moved tunnels onto Unified Routing and lost visibility into their dataplane traffic in the Network Analytics dashboard. No configuration change is required — analytics data is collected automatically for all accounts with Unified Routing enabled. For the remaining beta limitations, refer to [Traffic steering beta limitations](https://edgetunnel-b2h.pages.dev/cloudflare-wan/reference/traffic-steering/#beta-limitations). May 12, 2026 1. ### [Refreshed Access login page](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-12-access-login-page-refresh/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) The [Access login page](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/custom-pages/access-login-page/) and [one-time password (OTP)](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/one-time-pin/) page now feature a refreshed design that improves visual consistency, user trust, and mobile responsiveness. **Before:** ![Screenshot of the previous Access login page](https://edgetunnel-b2h.pages.dev/_astro/access-login-old.CwNVkCQH_Z187ARH.webp) **After:** ![Screenshot of the updated Access login page](https://edgetunnel-b2h.pages.dev/_astro/access-login-new.Y7WUfg9G_1QeY33.webp) The updated login experience includes: * **Unified authentication card** \- All sign-in options (identity provider buttons, email input, OTP) now appear in a single card with consistent styling, replacing the previous multi-section layout. * **Consistent button styling** \- Identity provider buttons use a uniform size and layout for easier scanning and selection. * **Better mobile experience** \- Responsive layout improvements ensure the login page renders correctly on phones and tablets. * **Dark mode support** \- The login page now supports dark mode. May 12, 2026 1. ### [New accounts assigned a single IPv4 anycast address](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-12-single-anycast-ip-default/) [ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Magic Transit ](https://edgetunnel-b2h.pages.dev/magic-transit/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/) New Magic Transit and Cloudflare WAN accounts are now assigned a single IPv4 anycast address by default. Cloudflare handles failures on its network automatically by advertising your endpoint IP from multiple nodes across many globally distributed data centers. To handle failures on your network, configure two tunnels from separate routers. To request additional anycast IP addresses for your account, contact your account team. For tunnel configuration guidance, refer to [Configure tunnel endpoints](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/how-to/configure-tunnel-endpoints/) for Cloudflare WAN or [Configure tunnel endpoints](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/configure-tunnel-endpoints/) for Magic Transit. May 12, 2026 1. ### [Create Gateway firewall policies with natural language](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-12-natural-language-policy-creation/) [ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) Cloudflare Gateway now supports natural language policy creation for [DNS](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/), [HTTP](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/), and [Network](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/) firewall policies. Administrators can describe the outcome they want in plain language, and Cloudflare will generate a complete policy rule that populates the policy builder form. ![Create with AI button on the Gateway firewall policies page](https://edgetunnel-b2h.pages.dev/_astro/gateway-create-with-ai.BYG07coh_1T38Vz.webp) To create a policy with natural language, select **Create with AI** on any Gateway firewall policy tab. Choose a policy type, describe what the policy should do, and a fully configured rule will appear in the policy builder for review. You can edit any field before saving, or re-generate with a different prompt. The generated policy incorporates your account context - including lists, DLP profiles, applications, and device posture checks - so that references to your existing resources resolve automatically. A built-in feedback mechanism allows you to rate each generated policy and provide optional comments, which Cloudflare uses to improve output quality over time. For more information, refer to [Gateway firewall policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/). May 11, 2026 1. ### [Cloudflare One Client for Windows (version 2026.4.1350.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-11-warp-windows-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: * Right click context menu to access the most common client actions quickly * Built-in captive portal login experience **Additional Changes and improvements** * Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. **Known issues** * Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process. * An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. * Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option. * DNS resolution may be broken when the following conditions are all true: * The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. * A custom DNS server address is configured on the primary network adapter. * The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface. May 11, 2026 1. ### [Cloudflare One Client for macOS (version 2026.4.1350.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-11-warp-macos-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: * Right click context menu to access the most common client actions quickly * Built-in captive portal login experience **Additional Changes and improvements** * Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. **Known issues** * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. May 11, 2026 1. ### [Cloudflare One Client for Linux (version 2026.4.1350.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-11-warp-linux-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Linux! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: * Right click context menu to access the most common client actions quickly * Built-in captive portal login experience **Changes and improvements** * Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. * Official support for RHEL 9 has been added for Cloudflare Mesh nodes. To install the RHEL 9 package, the Extra Packages for Enterprise Linux (EPEL) repository must be active, as it contains dependencies required for the tray icon and captive portal webview. **Known issues** * Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. * Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. May 11, 2026 1. ### [NAT-T support for IKE on UDP port 500](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-11-nat-t-port-500/) [ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Magic Transit ](https://edgetunnel-b2h.pages.dev/magic-transit/) Cloudflare IPsec now supports the standard NAT traversal (NAT-T) flow, where IKE begins on UDP port `500` and switches to UDP port `4500` after NAT is detected. Previously, devices behind NAT had to be configured to initiate IKE on UDP port `4500` directly. Devices that started on UDP port `500` could not complete the IKE handshake when NAT was in the path. This required custom configuration on devices such as VeloCloud SD-WAN edges, Cisco IOS-XE routers, and Juniper SRX firewalls, and was not possible on every platform. What changed: * Devices behind NAT can now initiate IKE on either UDP port `500` or UDP port `4500`. * Devices that start IKE on UDP port `500` and switch to UDP port `4500` after NAT detection now complete the handshake successfully. * No configuration change is required on Cloudflare. The change is available for all IPsec tunnels on Cloudflare WAN and Magic Transit. This change does not affect existing tunnels: * Tunnels using UDP port `500` with no NAT detected continue to operate as before. * Tunnels configured to start IKE on UDP port `4500` continue to operate as before. * NAT detection logic is unchanged. For configuration details, refer to [GRE and IPsec tunnels](https://edgetunnel-b2h.pages.dev/cloudflare-wan/reference/gre-ipsec-tunnels/). May 07, 2026 1. ### [Custom DHCP options on Cloudflare One Appliance](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-07-appliance-dhcp-options/) [ Cloudflare One Appliance ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) When the Cloudflare One Appliance is acting as the DHCP server for a LAN, you can now configure custom DHCP options on the leases it issues. This unlocks workflows such as PXE / iPXE boot, VoIP phone provisioning, and vendor-specific client configuration. Each option is defined by `option_number`, `value`, and one of four value types: `text`, `integer`, `hex`, or `ip`. Configurations are validated on the appliance before being applied — invalid configurations are rejected and the underlying error is returned to the API caller, so a bad option will not disrupt the live DHCP service. For details, refer to [DHCP server options](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/network-options/dhcp/dhcp-options/). May 07, 2026 1. ### [Source-based breakout and prioritization on Cloudflare One Appliance](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-07-appliance-source-based-breakout/) [ Cloudflare One Appliance ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) Breakout and traffic prioritization rules on the Cloudflare One Appliance can now match by **source** in addition to destination application. You can pin breakout or priority behavior to: * A source LAN interface — VLANs attached to that LAN are included automatically. * A source IP address, range, or CIDR block. This is the natural way to break out a guest VLAN to the local Internet, or to prioritize traffic from a specific subnet, without enumerating destination applications. For details, refer to [Breakout traffic](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/network-options/application-based-policies/breakout-traffic/#breakout-by-source). ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product-group/cloudflare-one/2/#page","headline":"Cloudflare One Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product-group/cloudflare-one/2/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```