Vendor239 problems· 2 reviewed

Cloudflare

239 incident problems in Cloudflare environments.

All problems (239)

SECURITY-1488A JWKS rotation completes and one edge still serves stale keysSome clients validate new JWTs while one edge location keeps serving the old compressed JWKS.SecurityAdvanced11 minPro SECURITY-1497A JWT issuer rotates keys and one gateway still rejects tokensOne gateway keeps rejecting new JWTs after key rotation while others recover immediately.SecurityAdvanced11 minPro SECURITY-1507A JWT issuer rotates keys and one gateway still rejects tokensOne gateway keeps rejecting new JWTs after key rotation while others recover immediately.SecurityAdvanced11 minPro NETWORK-1520A browser SSH app loads and still failsBrowser SSH fails only through one connector after an origin certificate renewal.NetworkAdvanced12 minPro NETWORK-1530A browser SSH app loads and still failsBrowser SSH fails only through one connector after origin certificate renewal.NetworkAdvanced12 minPro NETWORK-1510A Cloudflare Access app loads and browser SSH still failsBrowser SSH breaks only through one connector after origin certificate renewal.NetworkAdvanced12 minPro NETWORK-1500A Cloudflare Access application renders and SSH over browser still failsCloudflare Access browser SSH breaks only through one connector after an origin certificate renewal.NetworkAdvanced12 minPro SECURITY-1454A Cloudflare Access service token works for normal API calls and fails on one...A Cloudflare Access service token works for normal API calls and fails on... focuses on Identity And Access and asks the reader to isolate the key signal in Cloudflare. Upgrade paths often use different rule branches than ordinary HTTP re...SecurityAdvanced12 minPro NETWORK-1454A Cloudflare Tunnel health check stays green and real browser traffic failsA Cloudflare Tunnel health check stays green and real browser traffic fails focuses on edge-routing and asks the reader to isolate the key signal in Cloudflare. Tunnel health can stay green while only one real-user fallback transpo...NetworkAdvanced12 minPro NETWORK-1472A Cloudflare Tunnel status page stays green and regional traffic still failsOne region continues failing after a connector VM is restored from snapshot while health remains green.NetworkAdvanced12 minPro NETWORK-1476A DoH migration works for browsers and breaks one service meshMesh sidecars fail only during cold start after a DNS-over-HTTPS migration.NetworkAdvanced12 minPro CICD-1496A Flux image automation commit lands and promotion still stallsGitOps promotion appears correct in Git, but one region deploys the old image after a mirrored registry rollout.CI/CDAdvanced12 minPro CICD-1485A Flux image update commits the new tag and Argo still deploys the old digestGitOps promotion looks correct, yet one environment deploys the previous image after registry proxy caching changes.CI/CDAdvanced12 minPro SECURITY-1469A JWKS rotation succeeds and one edge cache still serves the old key setSome clients validate new JWTs while one region keeps seeing the old JWKS after rotation.SecurityAdvanced12 minPro SECURITY-1479A JWKS rotation succeeds and one edge still serves stale keysSome clients validate new JWTs while one edge path keeps serving the old compressed JWKS document.SecurityAdvanced12 minPro NETWORK-1458A recursive resolver over TLS stays healthy and validation still failsOne encrypted resolver path stops validating after an upstream key roll while ordinary DNS still works.NetworkAdvanced12 minPro NETWORK-1466A split-horizon DNS design works for browsers and fails for one API clientOnly one API client type reports certificate mismatch after moving to DoH.NetworkAdvanced12 minPro SECURITY-1365A Cloudflare Access app is protected on 443 and an alternate admin listener remains publicA team puts an app behind Cloudflare Access and later discovers a side-channel admin port on the same origin is still reachable directly.SecurityAdvanced13 minPro NETWORK-1462A Cloudflare origin route stays green and one region still failsOne region sees random gRPC failures after an underlay tunnel change while global health stays green.NetworkAdvanced13 minPro NETWORK-1429A new SaaS hostname is onboarded and only one campus failsA new SaaS hostname is onboarded and only one campus fails focuses on edge-routing and asks the reader to isolate the key signal in Cloudflare. New hostnames on shared CDNs can inherit old policy bundles long after DNS onboarding looks f...NetworkAdvanced13 minPro