# Cloudflared security related version upgrade needed **URL:** \ **Category:** Site Feedback and Other Questions\ **Created:** [October 26, 2026, 7:51pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896 "2026-10-26T19:51:46Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![andywob](https://forum.openwrt.org/letter_avatar/andywob/32/5_5575768a8748004e209b776fc1b2916d.png) [@andywob](https://forum.openwrt.org/u/andywob)\ **Post date:** [October 26, 2026, 7:51pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/1 "2026-10-26T19:51:46Z")
Hi folks, I have got an email from Cloudflare advices me to upgrade my tunnel within Openwrt in case of security issues as soon as possible to version 2026.10.3 or later. So I updated the software list manually, but there is no upgrade available. What can I do to solve this or who might able to help? Due to the fact, that this means all Openwrt installation who runs Cloudflare, this seems to be risky from my point of view... Many thanks for support upfront!! best Andy ---
**Author:** ![AndrewZ](https://forum.openwrt.org/letter_avatar/andrewz/32/5_5575768a8748004e209b776fc1b2916d.png) [@AndrewZ](https://forum.openwrt.org/u/AndrewZ)\ **Post date:** [October 26, 2026, 8:09pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/2 "2026-10-26T20:09:01Z")
> [@andywob](#): > > upgrade my tunnel within Openwrt Did they say that? This is what I received from them: > **To ensure the security of your account, please immediately deploy the latest stable release of Cloudflare One Client on all platforms.** This is a critical update because Cloudflare One Client configuration and tunnel management relies on the integrity of third party certificates that are now known to be compromised, as described in our [October 20 blog post](https://blog.cloudflare.com/emudhra-certificate-compromise/). Since I don't use "Cloudflare One Client" I don't care much. The certificate issue they mention is already mitigated in OpenWrt. ---
**Author:** ![Aisfkhan](https://forum.openwrt.org/user_avatar/forum.openwrt.org/aisfkhan/32/119678_2.png) [@Aisfkhan](https://forum.openwrt.org/u/Aisfkhan)\ **Post date:** [October 26, 2026, 8:33pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/3 "2026-10-26T20:33:14Z")
![IMG_0697](https://forum.openwrt.org/uploads/default/original/3X/b/f/bfd07aaa1e35f5c952e4970d806df193d4cd0d56.png) I received this and im ignoring this email. ---
**Author:** ![AndrewZ](https://forum.openwrt.org/letter_avatar/andrewz/32/5_5575768a8748004e209b776fc1b2916d.png) [@AndrewZ](https://forum.openwrt.org/u/AndrewZ)\ **Post date:** [October 26, 2026, 8:38pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/4 "2026-10-26T20:38:49Z")
Correct. Even if you run [cloudflared](https://openwrt.org/packages/pkgdata/cloudflared) on a router with OpenWrt, the program’s operation depends on an external certificate store (`ca-bundle`). Edit: what do they do in the updated version: hardcode filtering to reject the SHA-256 SPKI hashes belonging to the compromised eMudhra intermediate certificates. ---
**Author:** ![andywob](https://forum.openwrt.org/letter_avatar/andywob/32/5_5575768a8748004e209b776fc1b2916d.png) [@andywob](https://forum.openwrt.org/u/andywob)\ **Post date:** [October 26, 2026, 9:01pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/5 "2026-10-26T21:01:20Z")
... thanks for you reply. Nevertheless, they recommend to upgrade every instance. So, you really mean to ignore that? best Andy ---
**Author:** ![alexq](https://forum.openwrt.org/user_avatar/forum.openwrt.org/alexq/32/59273_2.png) [@alexq](https://forum.openwrt.org/u/alexq)\ **Post date:** [October 26, 2026, 9:08pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/6 "2026-10-26T21:08:40Z")
> [@AndrewZ](#): > > if you run [cloudflared](https://openwrt.org/packages/pkgdata/cloudflared) on a router My recently updated OpenWrt 25.12.6 has got cloudflared version 2026.8.3-r1 installed: ```plaintext root@OpenWrt:~# apk list --installed | grep cloudflared cloudflared-2026.8.3-r1 aarch64_cortex-a53 {feeds/packages/feeds/packages/net/cloudflared} (Apache-2.0) [installed] luci-app-cloudflared-1.2-r1 noarch {feeds/luci/feeds/luci/applications/luci-app-cloudflared} (Apache-2.0) [installed] root@OpenWrt:~# ``` The Openwrt git repo shows that the `cloudflared` package has been updated to version **2026.10.0** (but this is still below the recommended version 2026.10.2). - [https://github.com/openwrt/packages/tree/master/net/cloudflared](https://github.com/openwrt/packages/tree/master/net/cloudflared) Could the OpenWrt `cloudflared` package be updated to the latest recommended version? P.s.\> just received an email from Cloudflare with the subject: "_[Action Required] Upgrade your Cloudflare Tunnel to version 2026.10.2 or later_" ![6140](https://forum.openwrt.org/uploads/default/original/3X/f/c/fcd92222f9f4c1e281dd95bbe4999e517edc5aa7.jpeg) ---
**Author:** ![hnyman](https://forum.openwrt.org/user_avatar/forum.openwrt.org/hnyman/32/19_2.png) [@hnyman](https://forum.openwrt.org/u/hnyman)\ **Post date:** [October 26, 2026, 9:14pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/7 "2026-10-26T21:14:06Z")
> [@alexq](#): > > Could the OpenWrt `cloudflared` package be updated to the latest recommended version? Sure, please just author the necessary changes, compile and test them, and then propose them to to repo via a GitHub pull request. We are all volunteers here, just like you. ---
**Author:** ![AndrewZ](https://forum.openwrt.org/letter_avatar/andrewz/32/5_5575768a8748004e209b776fc1b2916d.png) [@AndrewZ](https://forum.openwrt.org/u/AndrewZ)\ **Post date:** [October 26, 2026, 9:39pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/8 "2026-10-26T21:39:05Z")
If you really need to use `cloudflared`, you will probably need to compile the desired version yourself for now. Alternatively, consider using a WireGuard client. The explanation why they suggest updating the apps on various platforms can be found [here](https://blog.talosintelligence.com/compromised-intermediate-certificates/), just scroll to "CVE-2026-111943". ---
**Author:** ![alexq](https://forum.openwrt.org/user_avatar/forum.openwrt.org/alexq/32/59273_2.png) [@alexq](https://forum.openwrt.org/u/alexq)\ **Post date:** [October 26, 2026, 9:55pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/9 "2026-10-26T21:55:27Z")
> [@andywob](#): > > So, you really mean to ignore that? I wouldn't recommend ignoring that. > [@AndrewZ](#): > > you really need to use `cloudflared` Is it a good idea to use the `cloudflared` binary from Cloudflare's [official github repository](https://github.com/cloudflare/cloudflared/releases)? I've just completed an AI-assisted update on my test router. Everything looks good, the tunnel works, and the Cloudflare dashboard confirms that client version `2026.10.4` is installed. ```plaintext root@OpenWrt:~# cloudflared --version cloudflared version 2026.10.4 (built 2026-10-26-11:13 UTC) root@OpenWrt:~# ``` ![6143](https://forum.openwrt.org/uploads/default/original/3X/c/f/cf6d8f6e902293ab7d149b6c3bfff2c238c56f6e.jpeg) ---
**Author:** ![AndrewZ](https://forum.openwrt.org/letter_avatar/andrewz/32/5_5575768a8748004e209b776fc1b2916d.png) [@AndrewZ](https://forum.openwrt.org/u/AndrewZ)\ **Post date:** [October 26, 2026, 10:12pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/10 "2026-10-26T22:12:38Z")
> [@alexq](#): > > Could the OpenWrt `cloudflared` package be updated to the latest recommended version? Tagging @1715173329 who is a maintainer of this package. ---
**Author:** ![andywob](https://forum.openwrt.org/letter_avatar/andywob/32/5_5575768a8748004e209b776fc1b2916d.png) [@andywob](https://forum.openwrt.org/u/andywob)\ **Post date:** [October 31, 2026, 8:41am UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/11 "2026-10-31T08:41:04Z")
Hi Andrew, I reached out to @1715173329 to this issue some days ago. Unfortunately no response or progress... Due to the fact that this might be a security relevant topic, what else can we do? I personally do not have the expertise neither the environment to compile the fix. Thanks in advance and best Andy ---
**Author:** ![AndrewZ](https://forum.openwrt.org/letter_avatar/andrewz/32/5_5575768a8748004e209b776fc1b2916d.png) [@AndrewZ](https://forum.openwrt.org/u/AndrewZ)\ **Post date:** [October 31, 2026, 4:58pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/12 "2026-10-31T16:58:27Z")
just thinking out loud... - wait for updated package - build it yourself - use WireGuard client if possible ---
**Author:** ![alexq](https://forum.openwrt.org/user_avatar/forum.openwrt.org/alexq/32/59273_2.png) [@alexq](https://forum.openwrt.org/u/alexq)\ **Post date:** [October 31, 2026, 9:20pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/13 "2026-10-31T21:20:53Z")
> [@andywob](#): > > what else can we do? I shared my mitigation idea above: - temporary replace the `/usr/bin/cloudflared` file on your router with the latest compiled binary from Cloudflare's official GitHub [release](https://github.com/cloudflare/cloudflared/releases) (make sure to choose the correct binary for your router's architecture). ![6212](https://forum.openwrt.org/uploads/default/original/3X/6/3/63a573a8e7e5fe8c558c34d4b6825d736849c662.jpeg) I guess it's better than staying on the outdated 2026.8.3 version ---
**Author:** ![azeu666](https://forum.openwrt.org/letter_avatar/azeu666/32/5_5575768a8748004e209b776fc1b2916d.png) [@azeu666](https://forum.openwrt.org/u/azeu666)\ **Post date:** [November 1, 2026, 10:34am UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/14 "2026-11-01T10:34:28Z")
(post deleted by author) ---
**Author:** ![1715173329](https://forum.openwrt.org/user_avatar/forum.openwrt.org/1715173329/32/24703_2.png) [@1715173329](https://forum.openwrt.org/u/1715173329)\ **Post date:** [November 1, 2026, 2:30pm UTC](https://forum.openwrt.org/t/cloudflared-security-related-version-upgrade-needed/254896/15 "2026-11-01T14:30:12Z")
This package was updated 2 days ago on 25.12 branch, so buildbot should have built this update for all architectures.