Securing non-human identities: automated revocation, OAuth, and scoped permissions
2026-04-26T19:24:07Z•c2a50b63568b71fb30a9e3f24650278511c63459a9211ab7c2b98f4f03507686
ACMEPQCPingoraRFC-9728account-abuseai-securityapi-tokensaspacertificate-validationcgnatclient-side-securitycloudflareddosdeveloper-securitykt-logsleast-privilegelog-explorermanaged-oauthoauthpost-quantumrequest-smugglingresource-scoped-permissionsthreat-reportvulnerability-scannerworkers-vpc
What happened
Cloudflare published a set of security-focused product updates, research and disclosures. Highlights include scannable API tokens, enhanced OAuth visibility and Managed OAuth for Access (RFC 9728) plus GA for resource-scoped permissions to enable least-privilege developer workflows; a target of 2029 for full post-quantum deployment; Client-Side Security opened to all users and AI Security for Apps GA; new Account Abuse Protection (Early Access); a Web/API vulnerability scanner; fixes for request smuggling in Pingora OSS (Pingora 0.8.0); mitigation for an ACME validation logic vulnerability; an
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cloudflare_security_blog
- Record identifier
- c2a50b63568b71fb30a9e3f24650278511c63459a9211ab7c2b98f4f03507686
- Enrichment time
- 2026-04-26T19:24:07Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.