--- title: Cloudflare One Changelog image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) Cloudflare One ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) Mar 01, 2026 1. ### [Clipboard controls for browser-based RDP](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-01-rdp-clipboard-controls/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) You can now configure clipboard controls for browser-based RDP with Cloudflare Access. Clipboard controls allow administrators to restrict whether users can copy or paste text between their local machine and the remote Windows server. ![Enable users to copy and paste content from their local machine to remote RDP sessions in the Cloudflare One dashboard](https://edgetunnel-b2h.pages.dev/_astro/rdp-clipboard-controls.B0ZmliDb_Z1Ne5yg.webp) This feature is useful for organizations that support bring-your-own-device (BYOD) policies or third-party contractors using unmanaged devices. By restricting clipboard access, you can prevent sensitive data from being transferred out of the remote session to a user's personal device. #### Configuration options Clipboard controls are configured per policy within your Access application. For each policy, you can independently allow or deny: * **Copy from local client to remote RDP session** — Users can copy/paste text from their local machine into the browser-based RDP session. * **Copy from remote RDP session to local client** — Users can copy/paste text from the browser-based RDP session to their local machine. By default, both directions are denied for new policies. For existing Access applications created before this feature was available, clipboard access remains enabled to preserve backwards compatibility. When a user attempts a restricted clipboard action, the clipboard content is replaced with an error message informing them that the action is not allowed. For more information, refer to [Clipboard controls for browser-based RDP](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#clipboard-controls). Feb 27, 2026 1. ### [Export MCP server portal logs with Logpush](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-27-mcp-portal-logpush/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) Availability Only available on Enterprise plans. [MCP server portals](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/) now supports [Logpush](https://edgetunnel-b2h.pages.dev/logs/logpush/) integration. You can automatically export MCP server portal activity logs to third-party storage destinations or security information and event management (SIEM) tools for analysis and auditing. #### Available log fields The MCP server portal logs dataset includes fields such as: * `Datetime` — Timestamp of the request * `PortalID` / `PortalAUD` — Portal identifiers * `ServerID` / `ServerURL` — Upstream MCP server details * `Method` — JSON-RPC method (for example, `tools/call`, `prompts/get`, `resources/read`) * `ToolCallName` / `PromptGetName` / `ResourceReadURI` — Method-specific identifiers * `UserID` / `UserEmail` — Authenticated user information * `Success` / `Error` — Request outcome * `ServerResponseDurationMs` — Response time from upstream server For the complete field reference, refer to [MCP portal logs](https://edgetunnel-b2h.pages.dev/logs/logpush/logpush-job/datasets/account/mcp%5Fportal%5Flogs/). #### Set up Logpush To configure Logpush for MCP server portal logs, refer to [Logpush integration](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/logpush/). Note MCP server portals is currently in beta. Feb 27, 2026 1. ### [New protocols added for Gateway Protocol Detection (Beta)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-27-new-protocol-detection-protocols/) [ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) Gateway [Protocol Detection](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/protocol-detection/) now supports seven additional protocols in beta: | Protocol | Notes | | ------------ | -------------------------------------------------- | | IMAP | Internet Message Access Protocol — email retrieval | | POP3 | Post Office Protocol v3 — email retrieval | | SMTP | Simple Mail Transfer Protocol — email sending | | MYSQL | MySQL database wire protocol | | RSYNC-DAEMON | rsync daemon protocol | | LDAP | Lightweight Directory Access Protocol | | NTP | Network Time Protocol | These protocols join the existing set of detected protocols (HTTP, HTTP2, SSH, TLS, DCERPC, MQTT, and TPKT) and can be used with the _Detected Protocol_ selector in [Network policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/) to identify and filter traffic based on the application-layer protocol, without relying on port-based identification. If protocol detection is enabled on your account, these protocols will automatically be logged when detected in your Gateway network traffic. For more information on using Protocol Detection, refer to the [Protocol detection documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/protocol-detection/). Feb 24, 2026 1. ### [WARP client for Windows (version 2026.1.150.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-24-warp-windows-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Windows WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features. **Changes and improvements** * Improvements to [multi-user mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-multiuser/). Fixed an issue where when switching from a pre-login registration to a user registration, Mobile Device Management (MDM) configuration association could be lost. * Added a new feature to [manage NetBIOS over TCP/IP](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#netbios-over-tcpip) functionality on the Windows client. NetBIOS over TCP/IP on the Windows client is now disabled by default and can be enabled in [device profile settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/). * Fixed an issue causing failure of the [local network exclusion](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. * Improvement for the Windows [client certificate posture check](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate/) to ensure logged results are from checks that run once users log in. * Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. * Fixed an issue where misconfigured DEX HTTP tests prevented new registrations. * Fixed an issue causing DNS requests to fail with clients in Traffic and DNS mode. * Improved service shutdown behavior in cases where the daemon is unresponsive. **Known issues** * For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. * Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. * DNS resolution may be broken when the following conditions are all true: * WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. * A custom DNS server address is configured on the primary network adapter. * The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. Feb 24, 2026 1. ### [WARP client for macOS (version 2026.1.150.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-24-warp-macos-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the macOS WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. **Changes and improvements** * Fixed an issue causing failure of the [local network exclusion](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. * Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. * Fixed an issue with DNS server configuration failures that caused tunnel connection delays. * Fixed an issue where misconfigured DEX HTTP tests prevented new registrations. * Fixed an issue causing DNS requests to fail with clients in Traffic and DNS mode. Feb 24, 2026 1. ### [WARP client for Linux (version 2026.1.150.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-24-warp-linux-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Linux WARP client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. WARP client version 2025.8.779.0 introduced an updated public key for Linux packages. The public key must be updated if it was installed before September 12, 2025 to ensure the repository remains functional after December 4, 2025\. Instructions to make this update are available at [pkg.cloudflareclient.com](https://pkg.cloudflareclient.com). **Changes and improvements** * Fixed an issue causing failure of the [local network exclusion](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. * Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. * Fixed an issue where misconfigured DEX HTTP tests prevented new registrations. * Fixed issues causing DNS requests to fail with clients in Traffic and DNS mode or DNS only mode. Feb 20, 2026 1. ### [Understand CASB findings instantly with Cloudy Summaries](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-20-cloudy-in-casb/) [ CASB ](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/) You can now easily understand your SaaS security posture findings and why they were detected with **Cloudy Summaries in CASB**. This feature integrates Cloudflare's Cloudy AI directly into your CASB Posture Findings to automatically generate clear, plain-language summaries of complex security misconfigurations, third-party app risks, and data exposures. This allows security teams and IT administrators to drastically reduce triage time by immediately understanding the context, potential impact, and necessary remediation steps for any given finding—without needing to be an expert in every connected SaaS application. To view a summary, simply navigate to your Posture Findings in the Cloudflare One dashboard (under **Cloud and SaaS findings**) and open the finding details of a specific instance of a Finding. Cloudy Summaries are supported on all available integrations, including Microsoft 365, Google Workspace, Salesforce, GitHub, AWS, Slack, and Dropbox. See the full list of supported integrations [here](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/). #### Key capabilities * **Contextual explanations** — Quickly understand the specifics of a finding with plain-language summaries detailing exactly what was detected, from publicly shared sensitive files to risky third-party app scopes. * **Clear risk assessment** — Instantly grasp the potential security impact of the finding, such as data breach risks, unauthorized account access, or email spoofing vulnerabilities. * **Actionable guidance** — Get clear recommendations and next steps on how to effectively remediate the issue and secure your environment. * **Built-in feedback** — Help improve future AI summarization accuracy by submitting feedback directly using the thumbs-up and thumbs-down buttons. #### Learn more * Learn more about managing [CASB Posture Findings](https://edgetunnel-b2h.pages.dev/cloudflare-one/cloud-and-saas-findings/) in Cloudflare. Cloudy Summaries in CASB are available to all Cloudflare CASB users today. Feb 20, 2026 1. ### [Manage Cloudflare Tunnel directly from the main Cloudflare Dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-20-tunnel-core-dashboard/) [ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) is now available in the main Cloudflare Dashboard at [Networking > Tunnels ↗](https://dash.cloudflare.com/?to=/:account/tunnels), bringing first-class Tunnel management to developers using Tunnel for securing origin servers. ![Manage Tunnels in the Core Dashboard](https://edgetunnel-b2h.pages.dev/_astro/tunnel-core-dashboard.BGPqaHfo_Pi6HO.webp) This new experience provides everything you need to manage Tunnels for [public applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/), including: * **Full Tunnel lifecycle management**: Create, configure, delete, and monitor all your Tunnels in one place. * **Native integrations**: View Tunnels by name when configuring [DNS records](https://edgetunnel-b2h.pages.dev/dns/manage-dns-records/how-to/create-dns-records/) and [Workers VPC](https://edgetunnel-b2h.pages.dev/workers-vpc/) — no more copy-pasting UUIDs. * **Real-time visibility**: Monitor [replicas](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) and Tunnel [health status](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/common-errors/#tunnel-status) directly in the dashboard. * **Routing map**: Manage all ingress routes for your Tunnel, including [public applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/), [private hostnames](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/), [private CIDRs](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/), and [Workers VPC services](https://edgetunnel-b2h.pages.dev/workers-vpc/), from a single interactive interface. #### Choose the right dashboard for your use case **Core Dashboard**: Navigate to [Networking > Tunnels ↗](https://dash.cloudflare.com/?to=/:account/tunnels) to manage Tunnels for: * Securing origin servers and [public applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/) with CDN, WAF, Load Balancing, and DDoS protection * Connecting [Workers to private services](https://edgetunnel-b2h.pages.dev/workers-vpc/) via Workers VPC **Cloudflare One Dashboard**: Navigate to [Zero Trust > Networks > Connectors ↗](https://one.dash.cloudflare.com/?to=/:account/networks/connectors) to manage Tunnels for: * Securing your public applications with [Zero Trust access policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) * Connecting users to [private applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) * Building a [private mesh network](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/#connecting-networks) Both dashboards provide complete Tunnel management capabilities — choose based on your primary workflow. #### Get started New to Tunnel? Learn how to [get started with Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) or explore advanced use cases like [securing SSH servers](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/) or [running Tunnels in Kubernetes](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/kubernetes/). Feb 19, 2026 1. ### [DEX Supports EU Customer Metadata Boundary](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-19-dex-supports-cmb-eu/) [ Digital Experience Monitoring ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/) [Digital Experience Monitoring (DEX)](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/dex/) provides visibility into [WARP](https://edgetunnel-b2h.pages.dev/warp-client/) device connectivity and performance to any internal or external application. Now, all DEX logs are fully compatible with Cloudflare's [Customer Metadata Boundary](https://edgetunnel-b2h.pages.dev/data-localization/metadata-boundary/) (CMB) setting for the 'EU' (European Union), which ensures that DEX logs will not be stored outside the 'EU' when the option is configured. If a Cloudflare One customer using DEX enables CMB 'EU', they will not see any DEX data in the Cloudflare One dashboard. Customers can ingest DEX data via [LogPush](https://edgetunnel-b2h.pages.dev/logs/logpush/), and build their own analytics and dashboards. If a customer enables CMB in their account, they will see the following message in the Digital Experience dashboard: "DEX data is unavailable because Customer Metadata Boundary configuration is on. Use Cloudflare LogPush to export DEX datasets." ![Digital Experience Monitoring message when Customer Metadata Boundary for the EU is enabled](https://edgetunnel-b2h.pages.dev/_astro/dex_supports_cmb.6YOLXjHN_ZJh3uv.webp) Feb 17, 2026 1. ### [Streamlined clientless browser isolation for private applications](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-17-clientless-access-for-private-apps/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) A new **Allow clientless access** setting makes it easier to connect users without a device client to internal applications, without using public DNS. ![Allow clientless access setting in the Cloudflare One dashboard](https://edgetunnel-b2h.pages.dev/_astro/allow-clientless-access.BHKwQuVt_1mLRiX.webp) Previously, to provide clientless access to a private hostname or IP without a [published application](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/routes/add-routes/#add-a-published-application-route), you had to create a separate [bookmark application](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/bookmarks/) pointing to a prefixed [Clientless Web Isolation](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) URL (for example, `https://.cloudflareaccess.com/browser/https://10.0.0.1/`). This bookmark was visible to all users in the App Launcher, regardless of whether they had access to the underlying application. Now, you can manage clientless access directly within your [private self-hosted application](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). When **Allow clientless access** is turned on, users who pass your Access application policies will see a tile in their App Launcher pointing to the prefixed URL. Users must have [remote browser permissions](https://edgetunnel-b2h.pages.dev/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) to open the link. Feb 17, 2026 1. ### [Policies for bookmark applications](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-17-policies-for-bookmarks/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) You can now assign [Access policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) to [bookmark applications](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/bookmarks/). This lets you control which users see a bookmark in the [App Launcher](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/app-launcher/) based on identity, device posture, and other policy rules. Previously, bookmark applications were visible to all users in your organization. With policy support, you can now: * **Tailor the App Launcher to each user** — Users only see the applications they have access to, reducing clutter and preventing accidental clicks on irrelevant resources. * **Restrict visibility of sensitive bookmarks** — Limit who can view bookmarks to internal tools or partner resources based on group membership, identity provider, or device posture. Bookmarks support all [Access policy configurations](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) except purpose justification, temporary authentication, and application isolation. If no policy is assigned, the bookmark remains visible to all users (maintaining backwards compatibility). For more information, refer to [Add bookmarks](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/bookmarks/). Feb 17, 2026 1. ### [Cloudflare One Product Name Updates](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-17-product-name-updates/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Cloudflare Network Firewall ](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/)[ Network Flow ](https://edgetunnel-b2h.pages.dev/network-flow/) We are updating naming related to some of our Networking products to better clarify their place in the Zero Trust and Secure Access Service Edge (SASE) journey. We are retiring some older brand names in favor of names that describe exactly what the products do within your network. We are doing this to help customers build better, clearer mental models for comprehensive SASE architecture delivered on Cloudflare. #### What's changing * **Magic WAN** → **Cloudflare WAN** * **Magic WAN IPsec** → **Cloudflare IPsec** * **Magic WAN GRE** → **Cloudflare GRE** * **Magic WAN Connector** → **Cloudflare One Appliance** * **Magic Firewall** → **Cloudflare Network Firewall** * **Magic Network Monitoring** → **Network Flow** * **Magic Cloud Networking** → **Cloudflare One Multi-cloud Networking** **No action is required by you** — all functionality, existing configurations, and billing will remain exactly the same. For more information, visit the [Cloudflare One documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/). Feb 13, 2026 1. ### [Fine-grained permissions for Access policies and service tokens](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-13-access-policy-service-token-permissions/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) Fine-grained permissions for **Access policies** and **Access service tokens** are available. These new resource-scoped roles expand the existing RBAC model, enabling administrators to grant permissions scoped to individual resources. #### New roles * **Cloudflare Access policy admin**: Can edit a specific [Access policy](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) in an account. * **Cloudflare Access service token admin**: Can edit a specific [Access service token](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/service-tokens/) in an account. These roles complement the existing resource-scoped roles for Access applications, identity providers, and infrastructure targets. For more information: * [Resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles) * [Role scopes](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/scope/) Note Resource-scoped roles is currently in beta. Feb 12, 2026 1. ### [Anycast IPs displayed on the dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-12-anycast-ips-on-dashboard/) [ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) Cloudflare WAN now displays your Anycast IP addresses directly in the dashboard when you configure IPsec or GRE tunnels. Previously, customers received their Anycast IPs during onboarding or had to retrieve them with an API call. The dashboard now pre-loads these addresses, reducing setup friction and preventing configuration errors. No action is required. All Cloudflare WAN customers can see their Anycast IPs in the tunnel configuration form automatically. For more information, refer to [Configure tunnel endpoints](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/how-to/configure-tunnel-endpoints/). Feb 11, 2026 1. ### [Post-quantum encryption support for Cloudflare One Appliance](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-11-appliance-post-quantum-encryption/) [ Cloudflare One Appliance ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) Cloudflare One Appliance version 2026.2.0 adds [post-quantum encryption](https://edgetunnel-b2h.pages.dev/ssl/post-quantum-cryptography/) support using hybrid ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). The appliance now uses TLS 1.3 with hybrid ML-KEM for its connection to the Cloudflare edge. During the TLS handshake, the appliance and the edge share a symmetric secret over the TLS connection and inject it into the ESP layer of IPsec. This protects IPsec data plane traffic against harvest-now, decrypt-later attacks. This upgrade deploys automatically to all appliances during their configured interrupt windows with no manual action required. For more information, refer to [Cloudflare One Appliance](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/). Feb 02, 2026 1. ### [Improved Accessibility and Search for Monitoring](https://edgetunnel-b2h.pages.dev/changelog/post/2026-02-02-improved-accessibility-search-for-monitoring/) [ Email security ](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/) We have updated the Monitoring page to provide a more streamlined and insightful experience for administrators, improving both data visualization and dashboard accessibility. * **Enhanced Visual Layout**: Optimized contrast and the introduction of stacked bar charts for clearer data visualization and trend analysis. ![visual-example](https://edgetunnel-b2h.pages.dev/_astro/monitoring-bar-charts.Bi-4BuXC_xiAlF.webp) * **Improved Accessibility & Usability**: * **Widget Search**: Added search functionality to multiple widgets, including Policies, Submitters, and Impersonation. * **Actionable UI**: All available actions are now accessible via dedicated buttons. * **State Indicators**: Improved UI states to clearly communicate loading, empty datasets, and error conditions. ![buttons-example](https://edgetunnel-b2h.pages.dev/_astro/monitoring-buttons.DORPJvP__1JBNhu.webp) * **Granular Data Breakdowns**: New views for dispositions by month, malicious email details, link actions, and impersonations. ![monthly-example](https://edgetunnel-b2h.pages.dev/_astro/monitoring-monthly-dispositions.CYuI5d9y_ZSVir3.webp) This applies to all Email Security packages: * **Advantage** * **Enterprise** * **Enterprise + PhishGuard** Jan 30, 2026 1. ### [BGP over GRE and IPsec tunnels](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-30-bgp-over-tunnels/) [ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Magic Transit ](https://edgetunnel-b2h.pages.dev/magic-transit/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/) Magic WAN and Magic Transit customers can use the Cloudflare dashboard to configure and manage BGP peering between their networks and their Magic routing table when using IPsec and GRE tunnel on-ramps (beta). Using BGP peering allows customers to: * Automate the process of adding or removing networks and subnets. * Take advantage of failure detection and session recovery features. With this functionality, customers can: * Establish an eBGP session between their devices and the Magic WAN / Magic Transit service when connected via IPsec and GRE tunnel on-ramps. * Secure the session by MD5 authentication to prevent misconfigurations. * Exchange routes dynamically between their devices and their Magic routing table. For configuration details, refer to: * [Configure BGP routes for Magic WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/how-to/configure-routes/#configure-bgp-routes) * [Configure BGP routes for Magic Transit](https://edgetunnel-b2h.pages.dev/magic-transit/how-to/configure-routes/#configure-bgp-routes) Jan 27, 2026 1. ### [WARP client for Windows (version 2026.1.89.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-27-warp-windows-beta/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new Beta release for the Windows WARP client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes, improvements, and new features. **Changes and improvements** * Improvements to [multi-user mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-multiuser/). Fixed an issue where when switching from a pre-login registration to a user registration, Mobile Device Management (MDM) configuration association could be lost. * Added a new feature to [manage NetBIOS over TCP/IP](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#netbios-over-tcpip) functionality on the Windows client. NetBIOS over TCP/IP on the Windows client is now disabled by default and can be enabled in [device profile settings](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/). * Fixed an issue causing failure of the [local network exclusion](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. * Improvement for the Windows [client certificate posture check](https://edgetunnel-b2h.pages.dev/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate/) to ensure logged results are from checks that run once users log in. * Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. **Known issues** * For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. * Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. * DNS resolution may be broken when the following conditions are all true: * WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. * A custom DNS server address is configured on the primary network adapter. * The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. Jan 27, 2026 1. ### [WARP client for macOS (version 2026.1.89.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-27-warp-macos-beta/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new Beta release for the macOS WARP client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and improvements. **Changes and improvements** * Fixed an issue causing failure of the [local network exclusion](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. * Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. Jan 27, 2026 1. ### [Configure Cloudflare source IPs (beta)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-27-configure-cloudflare-source-ips/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) Cloudflare source IPs are the IP addresses used by Cloudflare services (such as Load Balancing, Gateway, and Browser Isolation) when sending traffic to your private networks. For customers using legacy mode routing, traffic to private networks is sourced from public Cloudflare IPs, which may cause IP conflicts. For customers using Unified Routing mode (beta), traffic to private networks is sourced from dedicated, non-Internet-routable private IPv4 range to ensure: * Symmetric routing over private network connections * Proper firewall state preservation * Private traffic stays on secure paths Key details: * **IPv4**: Sourced from `100.64.0.0/12` by default, configurable to any `/12` CIDR * **IPv6**: Sourced from `2606:4700:cf1:5000::/64` (not configurable) * **Affected connectors**: GRE, IPsec, CNI, WARP Connector, and WARP Client (Cloudflare Tunnel is not affected) Configuring Cloudflare source IPs requires Unified Routing (beta) and the `Cloudflare One Networks Write` permission. For configuration details, refer to [Configure Cloudflare source IPs](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/how-to/configure-cloudflare-source-ips/). Jan 22, 2026 1. ### [Require Access protection for zones](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-22-deny-by-default-for-zones/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) You can now require Cloudflare Access protection for all hostnames in your account. When enabled, traffic to any hostname that does not have a matching Access application is automatically blocked. This deny-by-default approach prevents accidental exposure of internal resources to the public Internet. If a developer deploys a new application or creates a DNS record without configuring an Access application, the traffic is blocked rather than exposed. ![Require Cloudflare Access protection in the dashboard](https://edgetunnel-b2h.pages.dev/_astro/require-cloudflare-access-protection.BAUmTYOs_ZxNecb.webp) #### How it works * **Blocked by default**: Traffic to all hostnames in the account is blocked unless an Access application exists for that hostname. * **Explicit access required**: To allow traffic, create an Access application with an Allow or Bypass policy. * **Hostname exemptions**: You can exempt specific hostnames from this requirement. To turn on this feature, refer to [Require Access protection](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/require-access-protection/). Jan 22, 2026 1. ### [New granular API token permissions for Cloudflare Access](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-22-granular-api-token-permissions/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) Three new API token permissions are available for Cloudflare Access, giving you finer-grained control when building automations and integrations: * **Access: Organizations Revoke** — Grants the ability to [revoke user sessions](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/access-settings/session-management/#revoke-user-sessions) in a Zero Trust organization. Use this permission when you need a token that can terminate active sessions without broader write access to organization settings. * **Access: Population Read** — Grants read access to the [SCIM users and groups](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/users/scim/) synced from an identity provider to Cloudflare Access. Use this permission for tokens that only need to read synced user and group data. * **Access: Population Write** — Grants write access to the [SCIM users and groups](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/users/scim/) synced from an identity provider to Cloudflare Access. Use this permission for tokens that need to create or modify synced user and group data. These permissions are scoped at the account level and can be combined with existing Access permissions. For a full list of available permissions, refer to [API token permissions](https://edgetunnel-b2h.pages.dev/fundamentals/api/reference/permissions/). Jan 15, 2026 1. ### [Network Services navigation update](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-15-networking-navigation-update/) [ Magic Transit ](https://edgetunnel-b2h.pages.dev/magic-transit/)[ Cloudflare Network Firewall ](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Network Flow ](https://edgetunnel-b2h.pages.dev/network-flow/) The Network Services menu structure in Cloudflare's dashboard has been updated to reflect solutions and capabilities instead of product names. This will make it easier for you to find what you need and better reflects how our services work together. Your existing configurations will remain the same, and you will have access to all of the same features and functionality. The changes visible in your dashboard may vary based on the products you use. Overall, changes relate to [Magic Transit ↗](https://edgetunnel-b2h.pages.dev/magic-transit/), [Magic WAN ↗](https://edgetunnel-b2h.pages.dev/magic-wan/), and [Magic Firewall ↗](https://edgetunnel-b2h.pages.dev/cloudflare-network-firewall/). **Summary of changes:** * A new **Overview** page provides access to the most common tasks across Magic Transit and Magic WAN. * Product names have been removed from top-level navigation. * Magic Transit and Magic WAN configuration is now organized under **Routes** and **Connectors**. For example, you will find IP Prefixes under **Routes**, and your GRE/IPsec Tunnels under **Connectors.** * Magic Firewall policies are now called **Firewall Policies.** * Magic WAN Connectors and Connector On-Ramps are now referenced in the dashboard as **Appliances** and **Appliance profiles.** They can be found under **Connectors > Appliances.** * Network analytics, network health, and real-time analytics are now available under **Insights.** * Packet Captures are found under **Insights > Diagnostics.** * You can manage your Sites from **Insights > Network health.** * You can find Magic Network Monitoring under **Insights > Network flow**. If you would like to provide feedback, complete [this form ↗](https://forms.gle/htWyjRsTjw1usdis5). You can also find these details in the January 7, 2026 email titled **\[FYI\] Upcoming Network Services Dashboard Navigation Update**. ![Networking Navigation](https://edgetunnel-b2h.pages.dev/_astro/networking-overview-and-navigation.CeMgEFaZ_Z20HKl.webp) Jan 15, 2026 1. ### [Support for CrowdStrike device scores in User Risk Scoring](https://edgetunnel-b2h.pages.dev/changelog/post/2026-1-15-crowdstrike-score/) [ Risk Score ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/risk-score/) Cloudflare One has expanded its \[User Risk Scoring\] (/cloudflare-one/insights/risk-score/) capabilities by introducing two new behaviors for organizations using the \[CrowdStrike integration\] (/cloudflare-one/integrations/service-providers/crowdstrike/). Administrators can now automatically escalate the risk score of a user if their device matches specific CrowdStrike Zero Trust Assessment (ZTA) score ranges. This allows for more granular security policies that respond dynamically to the health of the endpoint. New risk behaviors The following risk scoring behaviors are now available: * CrowdStrike low device score: Automatically increases a user's risk score when the connected device reports a "Low" score from CrowdStrike. * CrowdStrike medium device score: Automatically increases a user's risk score when the connected device reports a "Medium" score from CrowdStrike. These scores are derived from \[CrowdStrike device posture attributes\] (/cloudflare-one/integrations/service-providers/crowdstrike/#device-posture-attributes), including OS signals and sensor configurations. Jan 15, 2026 1. ### [Verify WARP Connector connectivity with a simple ping](https://edgetunnel-b2h.pages.dev/changelog/post/2026-01-15-warp-connector-ping-support/) [ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) We have made it easier to validate connectivity when deploying [WARP Connector](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) as part of your [software-defined private network](https://edgetunnel-b2h.pages.dev/reference-architecture/architectures/sase/#connecting-networks). You can now `ping` the WARP Connector host directly on its LAN IP address immediately after installation. This provides a fast, familiar way to confirm that the Connector is online and reachable within your network before testing access to downstream services. Starting with [version 2025.10.186.0](https://edgetunnel-b2h.pages.dev/changelog/2026-01-13-warp-linux-ga/), WARP Connector responds to traffic addressed to its own LAN IP, giving you immediate visibility into Connector reachability. Learn more about deploying [WARP Connector](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) and building private network connectivity with [Cloudflare One](https://edgetunnel-b2h.pages.dev/cloudflare-one/). ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product-group/cloudflare-one/5/#page","headline":"Cloudflare One Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product-group/cloudflare-one/5/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```