Cloudflare One

Cloudflare WAN traffic can now use a Gateway processing region with Regional Services, keeping HTTPS traffic encrypted until Gateway forwards it to the selected region for TLS decryption and HTTP inspection. The feature requires unified routing, applies only to Gateway HTTP traffic rather than DNS or network policy processing, and is configured through your account team.

A read-only Data Localization Suite Overview in the Cloudflare dashboard consolidates Regional Services, Customer Metadata Boundary, and Geo Key Manager settings in one place instead of across several pages and APIs. Each tab lists per-product items with their region and links to the page where the setting is changed.

MCP tool-call analytics timeseries endpoints now accept a response_status query parameter taking success, error, cached, or all, and the default is success, so counts no longer include failed and cached calls unless response_status=all is set explicitly. Invalid or empty values return 400.

Organizations in Google's custom SCIM profiles beta can send user updates and deprovisioning events to Cloudflare One, but must configure a generic SAML identity provider because the dedicated Google Workspace integration does not support SCIM. Group membership is not synchronized through SCIM scope and must be sent as a groups attribute from the Google SAML app.

The Windows Cloudflare One Client beta now automatically selects Global Acceleration endpoints while the device is in the acceleration region and reconnects on network changes without user action, and can require an administrator-generated code to uninstall. Also applies measured tunnel MTUs between 1147 and 1199 bytes, sends proxy-mode hostnames to Cloudflare for resolution, and fixes split tunnel entries not applying until reconnect, blank UI after upgrade or wake, and stuck disconnected states on Windows on Arm.

The beta client now requires macOS 15.0, adds automatic endpoint selection for Global Acceleration that reconnects on network changes, and warns with a banner when the network limits tunnel MTU to a degraded or critically low value. Also fixes a managed registration being removed when the MDM configuration file was briefly missing, hostname-based split tunnel entries not applying until reconnect, and upgrades leaving the client without a running service.

From version 2026.10.0, Cloudflare Tunnel can normalize URLs before matching ingress rules, improving security for rules that require Cloudflare Access validation, with the path sent to the origin unchanged. The setting is off by default and will be turned on by default in new cloudflared releases starting 2027-01-25, so path-based routing should be tested before then.

The Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is generally available, granting read access and remote log streaming for specific Tunnel instances without write access or account-wide Tunnel access. It matches the existing granular Read role and adds log streaming, which Read does not include.

The GA Windows client release fixes an issue with building trusted certificate chains.

The macOS Cloudflare One Client reaches general availability on the stable download page. The hotfix addresses an issue building trusted certificate chains.

The GA Linux Cloudflare One Client build on the stable downloads page now fixes an issue with building trusted certificate chains.

Cloud Workload Security is now available in beta, applying policy controls to cloud API requests before they reach the cloud provider. Policies use request filters and Rego checks — for example, blocking requests that would make an R2 bucket public — and are managed in the Cloudflare dashboard with the CWS proxy running in your environment. Requires a Zero Trust subscription; the Free plan is sufficient.

Data loss prevention custom pattern entries can call Cloudflare Workers in your account to validate matches with organization-specific logic, adjusting a match's confidence or rejecting it outright.

Cloudflare WAN and Magic Transit IPsec and GRE tunnels now support BGP import and export filtering, with reusable filter profiles specifying an allow or deny action and CIDR targets using exact, more-specific, or prefix-length matching. Each tunnel supports one import and one export filter, creatable via dashboard, API, or Terraform, and profile changes apply without resetting the BGP session.

Custom applications can now be created in the Application Library and referenced in Gateway DNS, Network, and HTTP policies, defined by hostnames, IP subnets, or both, with optional TCP or UDP ports or port ranges to restrict HTTP and Network matching. The release also improves search and filtering in the Application Library, updates the interfaces, data, and metrics used to review applications, and makes selecting and managing applications in the Gateway policy builder easier.