Download Cloudflare One Client

Pin this version: winget install --id Cloudflare.Warp --version 26.8.2115.0 --exact

This hotfix addresses an issue building trusted certificate chains.

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.8.2115.0

Pin this version: winget install --id Cloudflare.Warp --version 26.8.2110.0 --exact

This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply.

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.8.2110.0

Pin this version: winget install --id Cloudflare.Warp --version 26.8.2100.0 --exact

This release includes the following highlights: - Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across tunnel reconnections. - Support for routing non-RFC 1918 local IPv4 networks through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved connection reliability on devices with very large hosts files. The client now detects a large hosts file, allows more time for its initial DNS check, and shows a banner letting the user know that connecting may take longer. - Faster tunnel reconnections and lower memory use. The hosts file is now read once and shared across the client’s DNS resolvers instead of being reloaded by each one. - A service recovery mechanism, backed by a Windows scheduled task, now starts the client service on system unlock if it is not already running. This is enabled by default. Additional changes and improvements - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Individual DNS-over-HTTPS queries now time out instead of hanging when the upstream server stops responding. - Improved API reliability by retrying…

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.8.2100.0

Pin this version: winget install --id Cloudflare.Warp --version 26.7.1376.0 --exact

Fixed a rare but critical issue where the client could fail to connect or switch organizations due to an invalid registration after switching installed client versions. Additionally, this hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms.

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.7.1376.0

Pin this version: winget install --id Cloudflare.Warp --version 26.7.1343.0 --exact

When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary. When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks. Additional changes and improvements - Fixed a process leak in the Windows GUI that could exhaust system resources during IPC client-creation failures. - Fixed being unable to switch organizations when the client was stuck in the “Device not in organization” state. - Fixed an issue where Microsoft Defender would falsely flag the Cloudflare One Client installation as malicious when installing with Intune. - Made the Windows domain-joined posture check more reliable. - A DNS search domain parsing failure no longer prevents connection. - Cloud icon now correctly reflects actual connection status instead of showing disconnected while fully connected. - Fixed missing certificate error display due to a race condition. - Fixed empty black window after transitioning from docked dual displays to undocked/internal display. Known issues - None For Zero Trust documentation please see…

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.7.1343.0

Pin this version: winget install --id Cloudflare.Warp --version 26.6.905.0 --exact

This hotfix addresses an uncommon and intermittent case on Windows devices where the device is unable to reconnect after the device is woken from sleep.

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.6.905.0

Pin this version: winget install --id Cloudflare.Warp --version 26.6.880.0 --exact

This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers. The client now sends fallback DNS queries over UDP first, falling back to TCP only when a response is truncated, instead of querying both protocols in parallel.

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.6.880.0

Pin this version: winget install --id Cloudflare.Warp --version 26.6.850.0 --exact

This hotfix addresses a Windows authentication issue in the embedded WebView2 browser. Single sign-on could fail to use the Windows primary account, causing users to be prompted for an interactive sign-in. The embedded authentication browser now allows SSO providers to use the OS primary account when available.

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.6.850.0

Pin this version: winget install --id Cloudflare.Warp --version 26.6.822.0 --exact

This release introduces multiple features from our previous beta release into stable release, including: - The client now applies DNS search suffixes configured in your device profile / network policy. Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See DNS search suffixes for details. - Added mandatory authentication. When enabled via MDM, the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates, closing the visibility gap on newly deployed devices and during re-authentication. See the announcement blog and documentation for details. - Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See Hardware-backed registration for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See Extra debug logging for details. - The local…

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.6.822.0

Pin this version: winget install --id Cloudflare.Warp --version 26.4.1390.0 --exact

This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience Additional Changes and improvements - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. - Fixed a proxy mode connection stall issue. Known issues - Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process. - An error indicating that Microsoft Edge can’t read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - Registration may hang at “Checking your organization configuration” due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via warp-cli tunnel ip and warp-cli tunnel host. UI support will be added in a future release. - Windows ARM may prompt the user to close running applications while trying to…

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.4.1390.0

Pin this version: winget install --id Cloudflare.Warp --version 26.4.1350.0 --exact

This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience Additional Changes and improvements - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. Known issues - Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process. - An error indicating that Microsoft Edge can’t read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - Registration may hang at “Checking your organization configuration” due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work…

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.4.1350.0

Pin this version: winget install --id Cloudflare.Warp --version 26.3.851.0 --exact

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.3.851.0

Pin this version: winget install --id Cloudflare.Warp --version 26.1.150.0 --exact

Release notes

Manifest: manifests/c/Cloudflare/Warp/26.1.150.0

Pin this version: winget install --id Cloudflare.Warp --version 25.10.186.0 --exact

Release notes

Manifest: manifests/c/Cloudflare/Warp/25.10.186.0

Pin this version: winget install --id Cloudflare.Warp --version 25.9.558.0 --exact

Release notes

Manifest: manifests/c/Cloudflare/Warp/25.9.558.0

Pin this version: winget install --id Cloudflare.Warp --version 25.8.779.0 --exact

Release notes

Manifest: manifests/c/Cloudflare/Warp/25.8.779.0

Pin this version: winget install --id Cloudflare.Warp --version 25.7.176.0 --exact

Release notes

Manifest: manifests/c/Cloudflare/Warp/25.7.176.0

Pin this version: winget install --id Cloudflare.Warp --version 25.6.1400.0 --exact

Release notes

Manifest: manifests/c/Cloudflare/Warp/25.6.1400.0

Pin this version: winget install --id Cloudflare.Warp --version 25.6.1335.0 --exact

Release notes

Manifest: manifests/c/Cloudflare/Warp/25.6.1335.0

Pin this version: winget install --id Cloudflare.Warp --version 25.5.943.0 --exact

Release notes

Manifest: manifests/c/Cloudflare/Warp/25.5.943.0