Cloudflare updates cloudflared to block forged certificates

Cloudflare has released an urgent update for cloudflared, pushing users to version 2026.10.2 or newer. The patch addresses a cryptographic compromise stemming from leaked eMudhra intermediate certificate authorities’ private keys. Older cloudflared versions blindly trust these tainted certificate chains, meaning threat actors in possession of the stolen keys could forge certificates and impersonate legitimate upstream endpoints.

Cloudflare’s advisory notes that eight eMudhra intermediates were generated with insufficient key entropy, enabling external researchers to factor the weak private keys and construct counterfeit certificate hierarchies. The update revokes trust in these compromised authorities across the tunnel ecosystem.

Remediation guidance emphasises installing the patched binaries immediately, as detailed in the 2026.10.2 release notes on GitHub. The fix applies to both locally managed tunnels and remotely orchestrated configurations. Administrators using package repositories should run automated updates, while containerised environments must pull refreshed images and redeploy running pods. Importantly, changes to Cloudflare’s dashboard settings cannot substitute for upgrading the cloudflared daemon itself.

Downtime is expected: upgrading the executable requires a restart of the background daemon, which briefly interrupts active connections. For high-availability deployments, Cloudflare recommends rolling upgrades behind load balancers and maintaining redundant daemons to ensure continuous operation while all running processes are migrated to modern builds, thereby ensuring defence against certificate spoofing.