Cloudflare One Client - Cloudflare One Client for Linux (version 2026.6.822.0)

<p>A new GA release for the Linux Cloudflare One Client is now available on the <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/">stable releases downloads page</a>.</p> <p>This release introduces multiple features from our previous beta release into stable release, including:</p> <ul> <li>The client now applies DNS search suffixes configured in your <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles">device profile</a> / <a href="https://developers.cloudflare.com/cloudflare-one/traffic-policies/network-policies">network policy</a>. Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes">DNS search suffixes</a> for details.</li> <li>Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/">Hardware-backed registration</a> for details.</li> <li>Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume.</li> <li>Added new warp-cli debug commands for interactive connection diagnosis. See <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging">Extra debug logging</a> for details.</li> <li>The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client.</li> <li>Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs">Cloudflare One MDM documentation</a> for details.</li> </ul> <p><strong>Additional changes and improvements</strong></p> <ul> <li>Starting with 2026.6.822.0, the client unifies all API requests under the <code>api.devices.cloudflare.com</code> SNI, where previously both <code>zero-trust-client.cloudflareclient.com</code> and <code>notifications.cloudflareclient.com</code> were used. Review <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/">Cloudflare One Client with firewall</a> to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected.</li> <li><a href="https://developers.cloudflare.com/mesh/">Cloudflare Mesh</a> functionality using the Cloudflare One Client is now supported on RHEL 9 and 10.</li> <li>Cloudflare Mesh now supports <a href="https://developers.cloudflare.com/mesh/features/routes/#hostname-routes">hostname-based routing</a>.</li> <li>Client Certificate device-posture checks now support template variables (e.g. <code>${serial_number}</code>, <code>${device_uuid}</code>) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry.</li> <li>Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the system display settings.</li> <li>Path MTU Discovery (PMTUD) is now enabled by default.</li> <li>Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser.</li> <li>Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests.</li> <li>Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry.</li> <li>Fixed an issue where some Debian releases experienced inaccurate version reporting for posture checks.</li> <li>Users can now register with team names in any case format without errors.</li> <li>New UI fixes <ul> <li>Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication.</li> <li>Added a re-auth button and banner to the home screen so users don't miss it when their session expires.</li> <li>Added clear error messaging when the Cloudflare certificate needs to be installed.</li> <li>Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users.</li> <li>New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration.</li> <li>Added ability to configure proxy mode for consumer users.</li> <li>Added back the option to quit for consumer users.</li> </ul> </li> </ul> <p>For RHEL deployments, this release introduces a dependency on the <a href="https://docs.fedoraproject.org/en-US/epel/">Extra Packages for Enterprise Linux</a> repository (EPEL). The EPEL repository provides packages that support the captive portal detection’s in-app browser authentication and system tray icon. See <a href="https://docs.fedoraproject.org/en-US/epel/getting-started/">Getting started with EPEL</a> for instructions on enabling EPEL.</p> <p><strong>Known issues</strong></p> <ul> <li>Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.</li> </ul>