Fix for Bot Management Cookie Issue with Cloudflare for SaaS (O2O) Deployments

What to do

• Check whether you use Cloudflare Bot Management. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2026-03-12 20:40 UTC and 2026-03-12 20:40 UTC may need a replay.

• Subscribe to Cloudflare's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=cloudflare works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Cloudflare 1

1. resolvedMar 12, 2026, 8:40 PM UTC

   Cloudflare is deploying a fix for a bug affecting customers using Bot Management with Cloudflare for SaaS origin-to-origin (O2O) configurations. These customers may have observed an issue where the __cf_bm cookie was repeatedly being reset on each O2O request. This occurred because the bot cookie code runs twice during O2O requests – once on the eyeball zone and once on the origin zone – causing the cookie to be overwritten due to a mismatch in origin and eyeball domains. A fix is being implemented to prevent the __cf_bm cookie from being set on the origin hop of O2O requests. This will allow eyeball zones to properly utilize session scoring functionality and improve cacheability for O2O requests. The fix is expected to be completed by March 16, 2026.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.