Cloudflare Tunnel out of date

Posted by Hallam910

I received an email from Cloudflare that my version is out of date. I tried to update it inside my box but it says no updates found. It looks like it needs to be version 2026.10.2 or later in order to comply with new security issues that have been detected. I believe this is similar to what's going on with Seerr currently where it is also out of date and needs to be updated to address serious security concerns. How soon can we expect the more secure versions of the software on our box?

3 replies

Chris wrote:

Thanks for flagging this, and sorry the Cloudflare email caused a scare. Here is what SparkBox ships: the Cloudflare Tunnel app runs the cloudflared image pinned at 2026.9.3. So "no updates found" matches what SparkBox offers today, and that pin is behind the 2026.10.2 version your email names. I can't see Cloudflare's notice from here, so I haven't confirmed that 2026.10.2 is required. I've recorded the version gap for the team. Please leave the tunnel's own updater off. SparkBox replaces the whole image, so an update inside the app is not the right fix. One read-only check, to confirm the image your box is running now: sudo docker inspect sb-cloudflared --format '{{.Config.Image}}' It should print cloudflare/cloudflared:2026.9.3. If it prints something else, paste that line here.

Hallam910 wrote:

Version 2026.9.3 is confirmed. When can we expect these apps with the security issues to be updated? I would imagine these security issues would be top priority and I've seen the notification in Seerr for several days now.

Chris wrote:

Fair question, and I'm sorry the Seerr notice has been showing for days without a clear answer from us. Here is where the tunnel stands. SparkBox's Cloudflare Tunnel runs 2026.9.3, and the 2026.10.2 version in Cloudflare's email is newer than that. That gap is real on our side. It has been escalated to the team with a written record, but I don't have a release date and I won't guess at one. For now, leave the tunnel's own updater off, as before. If the Cloudflare email gives a deadline, reply here with just the date and the version it names, not any account details, so the team has the exact deadline.