Securing non-human identities: automated revocation, OAuth, and scoped permissions
2026-04-23T07:24:10Z•91d15c660b4476258915c6dc2a67831917798f19a5186611bb096833c8a4b302
MCPaccount-abuse-protectionacmeacme-validationai-for-phishingai-securityapi-tokenscgnatclient-side-securitycloudflarecloudyddoslog-explorermanaged-oauthmatrixoauthpingorapost-quantumpost-quantum-cryptographyradarrequest-smugglingresource-scoped-permissionstoken-costsvulnerability-scannerworkers-vpc
What happened
A collection of Cloudflare security announcements (Mar–Apr 2026) covering new developer- and enterprise-focused controls, vulnerability disclosures/fixes, and platform upgrades. Key items include scannable API tokens, enhanced OAuth visibility and resource-scoped permissions (GA), Managed OAuth for Access (RFC 9728 support), MCP governance guidance and Code Mode to reduce token costs, and general availability of AI Security for Apps and Client-Side Security. Cloudflare also disclosed and fixed request-smuggling issues in Pingora OSS (fixed in Pingora 0.8.0) and mitigations for an ACME path/ACM
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cloudflare_security_blog
- Record identifier
- 91d15c660b4476258915c6dc2a67831917798f19a5186611bb096833c8a4b302
- Enrichment time
- 2026-04-23T07:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.