Tunnel path-based ingress rules may match differently once URL normalization becomes default on 2027-01-25

Symptom

Requests that matched one ingress rule start matching another after upgrading cloudflaredPath-based routing for rules that require Cloudflare Access validation changes behavior

Cause

From cloudflared 2026.10.0 URLs can be normalized before ingress matching, off by default. New cloudflared releases from 2027-01-25 will turn it on by default, which can change which ingress rule matches. Configs without Access-validated rules are unaffected.

Fix

Turn normalization on now in a test environment and verify path routing before the default flips. You can also set TUNNEL_DISABLE_PATH_NORMALIZATION=false on each replica and restart it.

ApplyCopy

cloudflared tunnel --disable-path-normalization=false run <TUNNEL_NAME_OR_UUID>

Affected

cloudflared 2026.10.0 and later; default changes in releases from 2027-01-25

Sources

• https://developers.cloudflare.com/changelog/

Last verified 2026-10-24 · Confirmed by 0 builders