'%3e%3crect%20x='16'%20y='51'%20width='68'%20height='27'%20rx='13.5'/%3e%3ccircle%20cx='32'%20cy='53'%20r='15'/%3e%3ccircle%20cx='53'%20cy='43'%20r='20'/%3e%3ccircle%20cx='71'%20cy='57'%20r='12'/%3e%3c/g%3e%3c/svg%3e){kind=small}
Cloud Changelog
Cloudflare One changelog
96 announcements since February 2025 · 8 GA · 6 previews · 1 price change
Free. One email a day, only on days when something you follow has an announcement, or one a week if you switch it in your preferences. You confirm your email with a one-time code; there is no password.
November 20261
October 202619
Gateway HTTP inspection can run in a selected processing region with Regional Services
Inspect users and groups provisioned by each identity provider, with search and delete
User provisioning and deprovisioning from Google Workspace to Cloudflare One via generic SAML
HTML and Liquid templates for login, identity-denied, forbidden and command-line approval pages
Grants read access and log streaming for specific Tunnels without write accessGA
Route limit rises from 1,000 to 50,000 per account; extra tunnels cost $4.50 monthlyPrice
Custom applications defined by hostnames or IP subnets can be used in Gateway policies
BGP import and export filtering for IPsec and GRE tunnels using reusable filter profiles
Custom pattern entries can call Workers to adjust match confidence or reject matches
Forward action in HTTP policies runs Workers on permitted traffic, on all Zero Trust plansPreview
App-aware redirects include an account_id query parameter when account context is available
Configurable session duration, default 24 hours, closes active SSH connections when it elapses
DNS64 can be requested through location settings or EDNS option 65051
Zero Trust and main dashboard navigation combined; Zero Trust Network items removed
BGP peering for Cloudflare WAN and Magic Transit, open to all Unified Routing accountsGA
New setting returns 401 or 403 on failure and accepts only Service Auth policies
Inline target tagging now needs only Zero Trust Write token permission
September 202612
Role-based access control applies through Gateway account-level and resource-scoped roles
One endpoint for approved MCP servers, with Access logging of tool, prompt and resource activityGA
Guided dashboard onboarding for nodes and client devices, with one participant table
HTTP and Network policies can target how traffic exits Cloudflare, using net.offramp.type
Portals can connect to MCP servers on private networks through Cloudflare Gateway
Supports tagged targets and include, require and exclude target criteria matching hostname or tag
Tap-to-type prompt on iOS now appears inline over the focused text field instead of full-screen
Custom DHCP options can be configured from the dashboard when it acts as LAN DHCP server
Multiple routes can be created in one action from the Routes page
August 20267
Download from dashboard for VMware ESXi, Proxmox or libvirt/KVM
Infrastructure applications accept FIDO2 SSH keys, PIV keys, or both for MFA
Detects MCP traffic, adds a beta Is MCP policy selector and an AI security report dashboardPreview
Docker image runs Mesh nodes on Docker Compose, Kubernetes and OCI runtimes, amd64 and arm64
July 20268
Maximum DNS TTL setting caps upstream TTLs, from 60 to 36,000 seconds, at account or location level
Restart, reboot or shut down an appliance from the dashboard or API
Multiple PDFs can be printed as a single print job from the clipboard panel
Register and generate license key from the dashboard without contacting account team
Mesh nodes accept hostname routes for private and public hostnames, in addition to CIDR routes
June 20265
Resource-scoped roles for Gateway policies and Zero Trust lists, complementing account-level roles
Access service tokens let bots and agents connect without browser-based OAuth
Single page shows, tests and manages routes across Mesh, Tunnel, WAN and Magic Transit
Cloudflare identity provider is the default login method for new Zero Trust organizations
Guide for Cloudflare WAN updated with PQC, Policy-Based Routing and IP SLA
May 20269
Dashboard shows per-replica details for HA nodes and allows manual failover
Gateway policy regex selectors can be written and explained in natural language
Permissions can be scoped to individual Tunnel instances and Mesh nodes
Redesigned login and OTP pages with single card, mobile layout and dark mode
Custom DHCP options can be configured on leases issued by the appliance's DHCP server
Breakout and prioritization rules can now match by source LAN interface or IP range
Instances and license keys can be created, rotated and deleted via API and Terraform
April 20268
ML-KEM key agreement works with validated Cisco and Fortinet devices, no extra licensingGA
Logs now generated for all Gateway on-ramps, including PAC file proxy and Browser Isolation egress
LACP link aggregation bundles up to six LAN ports, in betaPreview
Refreshed log viewer adds field filters, customizable columns and detail view