Plugin Update or Removal

[MisterGlass]

First post.

I installed the plugin os-cloudflared (v1.1_1) from the OPNsense repository. In the Cloudflare dashboard the version of the tunnel is 2026.2.0, which is no longer supported or safe to use thanks to the compromised eMudhra certificates.


https://blog.cloudflare.com/emudhra-certificate-compromise

Cloudflare Tunnel (cloudflared)   Action the customer should take: Upgrade to 2026.10.2. For container deployments, update and redeploy the fixed image

I'm new to the OPNsense ecosystem and after reading this post I'm not sure who to contact. This plugin should be removed or updated. Do I email the maintainer or is this maintained by the (awesome) OPNsense team?


Cloudflare Tunnel integration
Integrates the Cloudflare Tunnel daemon (cloudflared) into OPNsense,
allowing self-hosted services to be exposed through Cloudflare Zero Trust
without requiring inbound firewall rules or a public IP address.

WWW: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/
Inspired by original work by Alan Martines <alancpmartines@hotmail.com>.
Maintainer: rick+github@insanityinside.net

[patient0]

Maintainer: rick+github@insanityinside.net

Since it's a community plugin, contacting the maintainer by the email address provided is the sensible approach.

On second thought: maybe open a issue on Github for it (https://github.com/opnsense/plugins), I see other changes were made by the OPNsense team.

Or even better, provide a pull request.
On third thought (and after a coffee): This plugin pulls in the FreeBSD 'net/couldflared' package. The upstream package is still on 2026.02 and has to be updated upstream. Since it got a runtime dependency on 'security/ca_root_nss', I'm wondering how affected the package itself is by the eMudhra issue. There is no mention of it in any release notes or git commits, beside docker images of cloudflared.

[newsense]

26.7.8 on Thursday will bring an updated ca_root_NSS and that may suffice for the tunnel to work assuming it's not hardcoded on emudhra.

Whether you'll get 2026.10.4 in OPNsense by Thursday...dunno exactly.

[sopex]

Yeah, it will be fixed with ca_root_nss   3.132 which will probably be released on Thursday.

When it comes to cloudflared itself... https://www.freshports.org/net/cloudflared