Cloudflare One Client 2026.7.1343.0 shipped 19 August 2026 with three different known-issue lists
Summary. Cloudflare published three separate changelog posts on 19 August 2026 announcing the same GA build, 2026.7.1343.0, for the Cloudflare One Client on Windows, macOS and Linux. The three posts do not describe the same release. The macOS post lists its known issues as "None". The Windows post carries a re-registration trap whose only documented fix is warp-cli registration delete. The Linux post carries a DNS resolution defect that only appears in DNS Only mode. The installer sizes differ by a factor of 2.6, from 59.5 MB on Windows to 153 MB on macOS, with Linux at 75.3 MB. An admin who reads one post and pushes the build to all three platforms through Intune or JAMF has read roughly a third of the release notes.
What Cloudflare actually shipped
The three posts share two headline items. Reauthentication prompts now redirect to the browser rather than the app window "when necessary", and the client learns which networks block HTTP/3 and reorders its fallback to try HTTP/2 first on those networks. Cloudflare frames the second as reducing "delays in time to connectivity when joining older or heavily filtered networks".
Below those two lines, the posts diverge. This is the table an admin needs before scheduling the rollout.
| Item | Windows | macOS | Linux |
|---|---|---|---|
| Installer size (19 Aug 2026) | 59.5 MB | 153 MB | 75.3 MB |
| Known issues listed | 1 | None | 1 |
| Microsoft Defender / Intune false-positive fix | Yes | Not listed | Not listed |
| Captive portal Wi-Fi crash fix | Not listed | Yes | Not listed |
| Cloudflare Mesh local-IP hostname route fix | Not listed | Not listed | Yes |
Four fixes do appear on all three: a DNS search domain parsing failure that previously prevented connection, a cloud icon that showed disconnected while the client was fully connected, a missing certificate error hidden by a race condition, and an empty black window after moving from docked dual displays to an internal display.
The Windows trap is a re-enrolment, not a reinstall
The Windows post states that if a user upgrades to 2026.7.1343.0, downgrades to an earlier version, re-registers, and then upgrades back to 2026.7.1343.0, "the client might fail to connect or switch organizations". The documented remedy is to run warp-cli registration delete or warp-cli registration delete-all.
That sequence is not exotic. It is the exact shape of a staged rollout that hits a problem: push the new build to a pilot ring, roll a subset back when something breaks, let those devices re-register against the old build, then push forward again once the fix lands. The remedy matters more than the trigger. Deleting the registration is not a repair of the local install; it removes the device's enrolment and the user has to enrol again, which on an SSO-backed Cloudflare One organisation means another identity provider round trip per device.
Windows also picks up two fixes the other platforms never list: a GUI process leak that "could exhaust system resources during IPC client-creation failures", and Microsoft Defender falsely flagging the client installation as malicious when installing with Intune. The second one is worth reading twice if a previous Intune push to Windows appeared to fail for no reason. Cloudflare's own deployment documentation, last updated 17 April 2026, names Intune and JAMF as the managed-deployment path, so this is the mainstream route for any fleet above a handful of machines.
The Linux defect is a split-DNS leak
The Linux post is the one with real blast radius. In DNS Only mode, the client "may send DNS queries for names that are configured for Local Domain Fallback to the encrypted DNS server instead of falling back to the system configuration". Cloudflare adds that Local Domain Fallback works as expected in other client modes.
To see why that is more than a connectivity annoyance, read it against the Local Domain Fallback documentation, last updated 1 May 2026. Local Domain Fallback exists so that named internal resources resolve against a private DNS server rather than the Gateway resolver. Cloudflare's own limitation note says those queries "bypass the Gateway resolver" and are therefore "not subject to Gateway DNS policies or DNS logging".
So on an affected Linux device in DNS Only mode, internal hostnames that should have gone to the private resolver go to the encrypted DNS server instead. Two consequences follow, and they point in opposite directions. Internal names that only the private resolver knows will fail to resolve, which is the visible symptom. Internal names that do resolve publicly will resolve, silently, through a path the operator did not choose. The first breaks a user's day. The second is the one to explain to a security reviewer.
The same page notes that when both Local Domain Fallback and resolver policies are configured for a device, Cloudflare applies client-side Local Domain Fallback rules first, and recommends keeping any fallback list to a maximum of eight servers to avoid performance issues. Fallback lists are scoped to a device profile, not to the account, so the exposure is per-profile rather than fleet-wide, which is what makes it worth checking rather than assuming.
The version streams were never in lockstep
The stable downloads page carries a full release history per platform, and the histories do not match. Windows received 2026.6.905.0 on 10 August 2026; macOS and Linux never did. Windows received 2026.6.850.0 on 7 July 2026 and Linux received 2026.6.836.0 on 1 July 2026, each on its own platform only. Back in April the streams forked on a point release: Windows took 2026.3.851.0 on 7 April 2026 while macOS and Linux took 2026.3.846.0 on 2 April 2026.
Read against that history, 19 August 2026 is the first date since 21 July 2026 that all three platforms sat on the same build. A shared version number on this client indicates a shared release train, not an identical binary with identical behaviour. Treating the number as a guarantee of parity is the mistake the three changelog posts are quietly warning about.
One more detail from the downloads page: its own "Last updated" stamp reads 29 June 2026, seven weeks before the release it lists. The per-platform "Latest release" blocks are current, correctly showing 2026.7.1343.0 dated 2026-08-19. The page-level date is not a reliable freshness signal here, which matters if a change-management process screenshots that stamp as evidence.
What to check before you push
Windows requirements on the downloads page are specific and worth confirming against the fleet inventory: Windows 10 LTSC, Windows 11, or a Windows 365 Cloud PC running Windows 11; AMD64 or ARM64; .NET Framework 4.7.2 or later; 184 MB of disk. Cloudflare recommends an MTU of 1381 bytes, with a documented minimum of 1281 bytes when Path MTU Discovery is in use.
For the Linux question specifically, the fastest answer is on the device rather than in the dashboard. Running warp-cli settings prints the fallback domains section, and the same data appears in warp_settings.txt inside client diagnostic logs. If a Linux device profile is in DNS Only mode and has a non-default fallback list, that is the population at risk. If no Linux profile uses DNS Only mode, the Linux known issue does not apply to the estate at all.
The Local Domain Fallback page also carries a warning that has nothing to do with this release but catches teams every time: fallback configuration changes where DNS requests get resolved, not where traffic goes. To stop traffic reaching a domain or IP, it has to be in the split tunnel configuration. The same page advises against routing all *.amazonaws.com resolution through a Route 53 Resolver, because public AWS endpoints such as ssm.us-east-1.amazonaws.com are not resolvable through internal VPC resolution and the AWS Console breaks for client users.
The pattern here is familiar from other endpoint agents. A version-number rollout plan built on one platform's release notes is the same failure mode as the AWS VPN Client 6.0 profile migration, where the platform-specific constraints sat outside the headline. Fleet-wide agent upgrades earn their risk register per platform, the same way declarative device management for iOS fleets forced a per-cohort plan rather than a single push.
What is still unknown
Cloudflare does not date the Windows defect's introduction, so there is no way to tell from the changelog whether earlier builds in the 2026.7 stream share it. The posts also do not say whether the Linux DNS Only defect predates 2026.7.1343.0 or arrived with it, which changes whether holding on the previous build is a mitigation or a coin flip. Neither post gives a target release for a fix. Until Cloudflare says otherwise, the safe reading is that both known issues are live on the current GA build.
FAQ
What version of the Cloudflare One Client went GA on 19 August 2026?
Cloudflare published 2026.7.1343.0 as a GA release for Windows, macOS and Linux on 19 August 2026, in three separate changelog posts. The stable downloads page lists installer sizes of 59.5 MB for Windows, 153 MB for macOS and 75.3 MB for Linux, all dated 2026-08-19.
Why do the three changelog posts differ if the version number is the same?
Each platform post lists its own fixes and its own known issues. The macOS post lists no known issues. Windows lists a re-registration failure after a downgrade and re-upgrade. Linux lists a Local Domain Fallback defect in DNS Only mode. Only two headline items appear on all three posts.
What is the Windows known issue in 2026.7.1343.0?
If a user upgrades to 2026.7.1343.0, downgrades to an earlier version, re-registers, then upgrades back to 2026.7.1343.0, the client might fail to connect or switch organizations. Cloudflare's documented remedy is running warp-cli registration delete or warp-cli registration delete-all, which removes the enrolment and requires the device to enrol again.
What breaks on Linux in DNS Only mode?
The client may send DNS queries for names configured for Local Domain Fallback to the encrypted DNS server instead of falling back to the system configuration. Cloudflare states Local Domain Fallback works as expected in the client's other modes, so the defect is scoped to Linux devices whose profile uses DNS Only mode.
Why does the Local Domain Fallback issue matter for security review?
Cloudflare's documentation states that Local Domain Fallback queries bypass the Gateway resolver and are not subject to Gateway DNS policies or DNS logging. When those queries go to the encrypted DNS server instead, internal names resolve through a path the operator did not select, and names known only to the private resolver stop resolving.
How do I tell which Linux devices are affected?
Local Domain Fallback lists are scoped to a device profile rather than the whole account. Run warp-cli settings on a device and read the fallback domains section, or collect client diagnostic logs and review the fallback domain section in warp_settings.txt. Devices on profiles without DNS Only mode are unaffected.
Were Windows, macOS and Linux previously on the same build?
No. Windows received 2026.6.905.0 on 10 August 2026, which macOS and Linux did not. Windows took 2026.6.850.0 on 7 July 2026 and Linux took 2026.6.836.0 on 1 July 2026, each platform-only. The 19 August 2026 release is the first shared build since 21 July 2026.
Is the downloads page date reliable for change management?
No. The page carries a "Last updated" stamp of 29 June 2026 while correctly listing 2026.7.1343.0 dated 2026-08-19 in each platform's latest release block. The page-level stamp lags the release content, so it should not be captured as evidence of currency in an approval record.
How eCorpIT can help
eCorpIT runs endpoint and Zero Trust agent rollouts for engineering estates that mix Windows, macOS and Linux, where a single version number rarely means a single risk profile. Our teams build the per-platform test matrix, verify DNS and split-tunnel behaviour against the device profiles actually in use, and stage the rollback path before the first ring goes out. If a Cloudflare One or comparable agent upgrade is on the change calendar, book a fleet upgrade review and we will work through the known-issue exposure with your operations team.
References
- Cloudflare One Client for Windows (version 2026.7.1343.0), Cloudflare changelog, 19 August 2026
- Cloudflare One Client for macOS (version 2026.7.1343.0), Cloudflare changelog, 19 August 2026
- Cloudflare One Client for Linux (version 2026.7.1343.0), Cloudflare changelog, 19 August 2026
- Download the Cloudflare One Client, stable releases and system requirements, Cloudflare docs
- Local Domain Fallback, Cloudflare One docs, last updated 1 May 2026
- Deploy the Cloudflare One Client, Cloudflare One docs, last updated 17 April 2026
- Managed deployment with MDM tools, Cloudflare One docs
- Path MTU Discovery, Cloudflare One docs
- Resolver policies, Cloudflare One docs
- Device profiles, Cloudflare One docs
- Split tunnel configuration, Cloudflare One docs
- Client diagnostic logs, Cloudflare One docs
- Cloudflare One Client documentation index, Cloudflare One docs
Last updated 23 August 2026.
Top comments (0)