Hi folks,
I have got an email from Cloudflare advices me to upgrade my tunnel within Openwrt in case of security issues as soon as possible to version 2026.10.3 or later.
So I updated the software list manually, but there is no upgrade available.
What can I do to solve this or who might able to help? Due to the fact, that this means all Openwrt installation who runs Cloudflare, this seems to be risky from my point of view...
Many thanks for support upfront!!
best
Andy
Did they say that?
This is what I received from them:
To ensure the security of your account, please immediately deploy the latest stable release of Cloudflare One Client on all platforms. This is a critical update because Cloudflare One Client configuration and tunnel management relies on the integrity of third party certificates that are now known to be compromised, as described in our October 20 blog post.
Since I don't use "Cloudflare One Client" I don't care much.
The certificate issue they mention is already mitigated in OpenWrt.
Correct. Even if you run cloudflared on a router with OpenWrt, the program’s operation depends on an external certificate store (ca-bundle).
Edit: what do they do in the updated version: hardcode filtering to reject the SHA-256 SPKI hashes belonging to the compromised eMudhra intermediate certificates.
... thanks for you reply. Nevertheless, they recommend to upgrade every instance. So, you really mean to ignore that?
best
Andy
My recently updated OpenWrt 25.12.6 has got cloudflared version 2026.8.3-r1 installed:
root@OpenWrt:~# apk list --installed | grep cloudflared
cloudflared-2026.8.3-r1 aarch64_cortex-a53 {feeds/packages/feeds/packages/net/cloudflared} (Apache-2.0) [installed]
luci-app-cloudflared-1.2-r1 noarch {feeds/luci/feeds/luci/applications/luci-app-cloudflared} (Apache-2.0) [installed]
root@OpenWrt:~#
The Openwrt git repo shows that the cloudflared package has been updated to version 2026.10.0 (but this is still below the recommended version 2026.10.2).
Could the OpenWrt cloudflared package be updated to the latest recommended version?
P.s.> just received an email from Cloudflare with the subject: "[Action Required] Upgrade your Cloudflare Tunnel to version 2026.10.2 or later"
Sure, please just author the necessary changes, compile and test them, and then propose them to to repo via a GitHub pull request.
We are all volunteers here, just like you.
If you really need to use cloudflared, you will probably need to compile the desired version yourself for now. Alternatively, consider using a WireGuard client.
The explanation why they suggest updating the apps on various platforms can be found here, just scroll to "CVE-2026-111943".
I wouldn't recommend ignoring that.
Is it a good idea to use the cloudflared binary from Cloudflare's official github repository?
I've just completed an AI-assisted update on my test router. Everything looks good, the tunnel works, and the Cloudflare dashboard confirms that client version 2026.10.4 is installed.
root@OpenWrt:~# cloudflared --version
cloudflared version 2026.10.4 (built 2026-10-26-11:13 UTC)
root@OpenWrt:~#
Tagging @1715173329 who is a maintainer of this package.
