On this page · 9 sections
Summary. Cloudflare published three separate changelog posts on 19 August 2026 announcing the same GA build, 2026.7.1343.0, for the Cloudflare One Client on Windows, macOS and Linux. The three posts do not describe the same release. The macOS post lists its known issues as "None". The Windows post carries a re-registration trap whose only documented fix is warp-cli registration delete. The Linux post carries a DNS resolution defect that only appears in DNS Only mode. The installer sizes differ by a factor of 2.6, from 59.5 MB on Windows to 153 MB on macOS, with Linux at 75.3 MB. An admin who reads one post and pushes the build to all three platforms through Intune or JAMF has read roughly a third of the release notes.
What Cloudflare actually shipped
The three posts share two headline items. Reauthentication prompts now redirect to the browser rather than the app window "when necessary", and the client learns which networks block HTTP/3 and reorders its fallback to try HTTP/2 first on those networks. Cloudflare frames the second as reducing "delays in time to connectivity when joining older or heavily filtered networks".
Below those two lines, the posts diverge. This is the table an admin needs before scheduling the rollout.
| Item | Windows | macOS | Linux |
|---|---|---|---|
| Installer size (19 Aug 2026) | 59.5 MB | 153 MB | 75.3 MB |
| Known issues listed | 1 | None | 1 |
| Microsoft Defender / Intune false-positive fix | Yes | Not listed | Not listed |
| Captive portal Wi-Fi crash fix | Not listed | Yes | Not listed |
| Cloudflare Mesh local-IP hostname route fix | Not listed | Not listed | Yes |
Four fixes do appear on all three: a DNS search domain parsing failure that previously prevented connection, a cloud icon that showed disconnected while the client was fully connected, a missing certificate error hidden by a race condition, and an empty black window after moving from docked dual displays to an internal display.
The Windows trap is a re-enrolment, not a reinstall
The Windows post states that if a user upgrades to 2026.7.1343.0, downgrades to an earlier version, re-registers, and then upgrades back to 2026.7.1343.0, "the client might fail to connect or switch organizations". The documented remedy is to run warp-cli registration delete or warp-cli registration delete-all.
That sequence is not exotic. It is the exact shape of a staged rollout that hits a problem: push the new build to a pilot ring, roll a subset back when something breaks, let those devices re-register against the old build, then push forward again once the fix lands. The remedy matters more than the trigger. Deleting the registration is not a repair of the local install; it removes the device's enrolment and the user has to enrol again, which on an SSO-backed Cloudflare One organisation means another identity provider round trip per device.
Windows also picks up two fixes the other platforms never list: a GUI process leak that "could exhaust system resources during IPC client-creation failures", and Microsoft Defender falsely flagging the client installation as malicious when installing with Intune. The second one is worth reading twice if a previous Intune push to Windows appeared to fail for no reason. Cloudflare's own deployment documentation, last updated 17 April 2026, names Intune and JAMF as the managed-deployment path, so this is the mainstream route for any fleet above a handful of machines.
The Linux defect is a split-DNS leak
The Linux post is the one with real blast radius. In DNS Only mode, the client "may send DNS queries for names that are configured for Local Domain Fallback to the encrypted DNS server instead of falling back to the system configuration". Cloudflare adds that Local Domain Fallback works as expected in other client modes.
To see why that is more than a connectivity annoyance, read it against the Local Domain Fallback documentation, last updated 1 May 2026. Local Domain Fallback exists so that named internal resources resolve against a private DNS server rather than the Gateway resolver. Cloudflare's own limitation note says those queries "bypass the Gateway resolver" and are therefore "not subject to Gateway DNS policies or DNS logging".
So on an affected Linux device in DNS Only mode, internal hostnames that should have gone to the private resolver go to the encrypted DNS server instead. Two consequences follow, and they point in opposite directions. Internal names that only the private resolver knows will fail to resolve, which is the visible symptom. Internal names that do resolve publicly will resolve, silently, through a path the operator did not choose. The first breaks a user's day. The second is the one to explain to a security reviewer.
The same page notes that when both Local Domain Fallback and resolver policies are configured for a device, Cloudflare applies client-side Local Domain Fallback rules first, and recommends keeping any fallback list to a maximum of eight servers to avoid performance issues. Fallback lists are scoped to a device profile, not to the account, so the exposure is per-profile rather than fleet-wide, which is what makes it worth checking rather than assuming.
The version streams were never in lockstep
The stable downloads page carries a full release history per platform, and the histories do not match. Windows received 2026.6.905.0 on 10 August 2026; macOS and Linux never did. Windows received 2026.6.850.0 on 7 July 2026 and Linux received 2026.6.836.0 on 1 July 2026, each on its own platform only. Back in April the streams forked on a point release: Windows took 2026.3.851.0 on 7 April 2026 while macOS and Linux took 2026.3.846.0 on 2 April 2026.
Read against that history, 19 August 2026 is the first date since 21 July 2026 that all three platforms sat on the same build. A shared version number on this client indicates a shared release train, not an identical binary with identical behaviour. Treating the number as a guarantee of parity is the mistake the three changelog posts are quietly warning about.
One more detail from the downloads page: its own "Last updated" stamp reads 29 June 2026, seven weeks before the release it lists. The per-platform "Latest release" blocks are current, correctly showing 2026.7.1343.0 dated 2026-08-19. The page-level date is not a reliable freshness signal here, which matters if a change-management process screenshots that stamp as evidence.
What to check before you push
Windows requirements on the downloads page are specific and worth confirming against the fleet inventory: Windows 10 LTSC, Windows 11, or a Windows 365 Cloud PC running Windows 11; AMD64 or ARM64; .NET Framework 4.7.2 or later; 184 MB of disk. Cloudflare recommends an MTU of 1381 bytes, with a documented minimum of 1281 bytes when Path MTU Discovery is in use.
For the Linux question specifically, the fastest answer is on the device rather than in the dashboard. Running warp-cli settings prints the fallback domains section, and the same data appears in warp_settings.txt inside client diagnostic logs. If a Linux device profile is in DNS Only mode and has a non-default fallback list, that is the population at risk. If no Linux profile uses DNS Only mode, the Linux known issue does not apply to the estate at all.
The Local Domain Fallback page also carries a warning that has nothing to do with this release but catches teams every time: fallback configuration changes where DNS requests get resolved, not where traffic goes. To stop traffic reaching a domain or IP, it has to be in the split tunnel configuration. The same page advises against routing all *.amazonaws.com resolution through a Route 53 Resolver, because public AWS endpoints such as ssm.us-east-1.amazonaws.com are not resolvable through internal VPC resolution and the AWS Console breaks for client users.
The pattern here is familiar from other endpoint agents. A version-number rollout plan built on one platform's release notes is the same failure mode as the AWS VPN Client 6.0 profile migration, where the platform-specific constraints sat outside the headline. Fleet-wide agent upgrades earn their risk register per platform, the same way declarative device management for iOS fleets forced a per-cohort plan rather than a single push.
What is still unknown
Cloudflare does not date the Windows defect's introduction, so there is no way to tell from the changelog whether earlier builds in the 2026.7 stream share it. The posts also do not say whether the Linux DNS Only defect predates 2026.7.1343.0 or arrived with it, which changes whether holding on the previous build is a mitigation or a coin flip. Neither post gives a target release for a fix. Until Cloudflare says otherwise, the safe reading is that both known issues are live on the current GA build.
FAQ
How eCorpIT can help
eCorpIT runs endpoint and Zero Trust agent rollouts for engineering estates that mix Windows, macOS and Linux, where a single version number rarely means a single risk profile. Our teams build the per-platform test matrix, verify DNS and split-tunnel behaviour against the device profiles actually in use, and stage the rollback path before the first ring goes out. If a Cloudflare One or comparable agent upgrade is on the change calendar, book a fleet upgrade review and we will work through the known-issue exposure with your operations team.
References
Last updated 23 August 2026.
