--- title: Turbine On-Prem 26.5.1 Release slug: turbine-release-notes/k_WXvI-rlAZXM4sFFPgv1 createdAt: 2026-10-15T14:13:31.337Z --- *October 30, 2026* # Build Faster. Connect Smartly with AI. Scale Further. Turbine On-Prem **26.5.1** includes new features, enhancements, and bug fixes focused on high-volume automation, a more capable Hero AI Companion, and a smoother builder experience. This release extends Hero AI so the Hero AI Companion can call tools from registered MCP servers, and so external AI clients can call selected Turbine components through a Turbine MCP server. Application Builder now includes Build with Hero AI, so you can add or change fields, layout, and workflow from the same Hero AI Companion panel. Scale with confidence as data volumes grow. This release introduces powerful capabilities to help teams process large datasets more efficiently, accelerate high-volume workflows, and manage vulnerability workloads at scale by introducing Performance Applications and Big Data Native Action. With faster bulk record operations, enhanced support for performance-intensive applications, and advanced data processing, organizations can streamline complex operations and scale automation to meet growing demands. This release also makes it easier to distribute content across multiple tenants. A single content package can be deployed to multiple or all accessible tenants in one operation, eliminating the need to repeat the deployment for each tenant. Search Records, Hero AI, and HTTP actions can retry when a first attempt is empty or hits a transient error. Overall, Turbine **26.5.0** helps teams run larger automations more reliably and connect Hero AI to the tools they already use. ## Explore This Release? Take an interactive tour of the key features in Turbine 26.5 with the guided walk through below: :::Iframe{iframeHeight="700" code=""} ::: ## What's New in This Release? ### External MCP Tools in Hero AI Hero AI now supports the Model Context Protocol (MCP), an open standard for connecting AI to external tools and data sources. Administrators configure and manage those connections in Turbine so the Hero AI Companion and Hero AI Native Actions can use specialized tools for lookups and follow-up actions instead of switching to another product. This capability is available for Turbine Cloud and On-Prem. You add a remote server under External MCP Servers, enter a name and HTTPS URL, and choose authentication: No Auth, API Key, Bearer Token, or Basic Auth. You can add query parameters or extra headers when the remote server requires them. OAuth is not available in this release. On View Tools, Turbine discovers the advertised tools. Resources and prompts from the remote server are not supported. If discovery fails, you can still save the server and retry later. MCP tools are not available in Companion until you allow them on Hero AI Companion Configuration (up to 15). Companion users can view the allowed list from the wrench in the chat header (Hero AI Context & Tools). If External MCP Servers is missing from the Administrator rail, the Host capability is not enabled for the tenant. You can also add MCP Tools to Hero AI Native Actions. Once an External MCP Server has been added to the tenant, the tools from that server will be available to Hero AI Native Actions in the External Tools tab. For more information, see [External MCP Servers](https://docs.swimlane.com/turbine-user-guide/external-mcp-servers), [Hero AI Companion Configuration](https://docs.swimlane.com/turbine-user-guide/hero-ai-companion-configuration), and [Hero AI Native Action](https://docs.swimlane.com/turbine-user-guide/hero-ai-native-action). ### Turbine MCP Server for External AI Clients You can run Turbine as an MCP server so a non-Swimlane AI application or assistant can call selected tenant components as tools. Administrators create one or more servers at the tenant, choose exactly which components each server publishes, and monitor server status. Component runs that start from an MCP server are labeled in Operational Health. Authentication uses a generated URL and a Turbine personal access token in the Private-Token header. Role-based access control still applies to the published components. Turbine generates a unique URL for the MCP Server and provides a JSON configuration snippet to paste into the client. The copied snippet includes `"type": "http"` so Claude Desktop and Claude CLI accept the configuration. Cursor, ChatGPT, and Gemini CLI use the same snippet. Add the snippet in Cursor under Settings, Tools & MCP, Add Custom MCP, or in a custom Claude MCP file. Replace the placeholder with your personal access token. Do not put the token in the URL. If the client supports only OAuth catalog connectors, it cannot call a Turbine MCP server in this release. Regenerating the URL invalidates any URL you already shared. For more information, see [Turbine MCP Servers](https://docs.swimlane.com/turbine-user-guide/turbine-mcp-servers). ### Application Builder: Build with Hero AI Application Builder includes a Hero AI application builder agent so you can change an application that is already open using natural-language prompts. The agent does not create a new application. You can ask Companion to add or update fields, adjust the layout, or set up workflow rules. Select Build with Hero AI to enter Application Building Mode. The Workflow and Application builders stay on the same page, and Preview shows the record form before you save. Preview does not create a record. Hero AI highlights modified fields and presents a change summary so you can review AI-assisted updates before you keep them. Undo and Redo remain available while you edit. This keeps drafting, preview, and review in one workspace instead of moving between a separate chat and Application Builder. For more information, see [Application Builder](https://docs.swimlane.com/turbine-user-guide/application-builder) and [Hero AI Companion](https://docs.swimlane.com/turbine-user-guide/hero-ai-companion). ### Performance Applications Performance Applications are built for high-volume workloads such as vulnerability risk management, where records do not need the full Swimlane processing lifecycle (correlation, workflows, notifications, and similar processing). They store and process large data sets with less overhead so ingestion, transformation, and analytics can run at higher throughput. This capability is currently supported only for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem. The applications list does not include a create-from-scratch Performance Application action. In Application Builder, a bolt icon and the hover text Optimized for high data volumes identify the application. Built-in fields support search and sorting. You can hide built-in fields you do not need and add custom fields; custom fields do not support search and sorting in the application. :::hint{type="info"} Performance Applications are behind a feature flag and must be enabled; to enable this feature, contact Swimlane Support. ::: For more information, see [Application Builder](https://docs.swimlane.com/turbine-user-guide/application-builder) and [Manage Applications and Applets](https://docs.swimlane.com/turbine-user-guide/manage-applications-and-applets). ### Bulk Mode for Record Actions Create Record, Update/Create Record, and Delete Records now support Bulk mode so playbooks can process an array of records instead of looping one record at a time. Automation engineers can pass datasets such as arrays of objects or JSON into the native Create and Update actions, and can delete many records in one step. Use Bulk mode when the target is a Performance Application. This capability is currently only supported for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem. On Inputs, turn on Bulk mode, map the Bulk Input Source, select the Performance Application, and map the create or update fields. Required application fields stay required; map each one from the bulk source or a playbook property. Restrictions are not supported in Bulk mode. Configure restrictions on a single-record run, or apply them outside bulk. :::hint{type="info"} Bulk mode is behind a feature flag and must be enabled; to enable this feature, contact Swimlane Support. ::: For more information, see [Record Actions](https://docs.swimlane.com/turbine-user-guide/record-actions), [Create Record](https://docs.swimlane.com/turbine-user-guide/create-record), [Update/Create Record](https://docs.swimlane.com/turbine-user-guide/updatecreate-record), and [Delete Records](https://docs.swimlane.com/turbine-user-guide/delete-record). ### Big Data Native Action Canvas includes a Big Data native action for high-volume processing that a record-by-record Script or Transform Data step cannot keep up with. The action uses a distributed batch engine so playbooks can filter, normalize, enrich, or deduplicate large inputs in one optimized run instead of iterating row by row. Typical uses include vulnerability risk management and other large-file or large-array workloads. This capability is supported for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem. Add Big Data from the native actions panel. On Inputs, add an Attachment property, then map it with Add Playbook Property or Add Expression. Write a PySpark script on Script, then map outputs on Outputs. The script environment includes the familiar Script globals plus a Spark session and helpers for CSV and JSON attachments. Use Big Data when you need batch compute. Use the Script native action for sandboxed Python on a single action run. :::hint{type="info"} The Big Data native action is behind a feature flag and must be enabled; to enable this feature, contact Swimlane Support. These capabilities are not supported on Turbine On-Prem. ::: For more information, see [Using the Big Data Native Action](https://docs.swimlane.com/turbine-user-guide/using-the-big-data-native-action), [Native Actions](https://docs.swimlane.com/turbine-user-guide/native-actions), [Using the Script Native Action](https://docs.swimlane.com/turbine-user-guide/using-the-script-native-action), and [Using the Transform Data Native Action](https://docs.swimlane.com/turbine-user-guide/using-the-transform-data-native-action). ### Bulk Content Deployment Across Multiple Tenants Turbine Library now makes it easier to distribute content across multiple tenants. A single content package can be deployed to multiple or all accessible tenants in one operation, eliminating the need to repeat the deployment for each tenant. Users can select the target tenants, monitor deployment progress, and choose to **overwrite or skip** content that is already deployed. Deployment results and failures are available for follow-up, helping simplify content distribution across large multi-tenant environments. For more information, see [User Content Homepage](https://docs.swimlane.com/turbine-user-guide/user-content-homepage). ### Retry Mechanism for Search Records, Hero AI, and HTTP Actions Search Records and Hero AI previously ran once. In asynchronous pipelines a Search could run before the record existed and return empty results, and Hero AI could fail on a transient error. Those cases required Sleep steps or extra playbook logic. This release exposes the existing retry framework on Search Records and Hero AI. You configure retry count, interval, and conditions in the action. Search Records retries until a record is found. Hero AI retries until the action succeeds with no error. HTTP already had retry; this release adds a preset default condition so HTTP retry works without extra setup. Retry is not added for Update/Create, Create, or Delete Record in this release. For more information, see [Search Records](https://docs.swimlane.com/turbine-user-guide/search-records), [Hero AI Native Action](https://docs.swimlane.com/turbine-user-guide/hero-ai-native-action), and [Using the HTTP Request Native Action](https://docs.swimlane.com/turbine-user-guide/using-the-http-request-native-action). ### Unified Record Activity Record Activity is now the record history for a saved record. Open it from the history control on the record. Each change shows whether it came from a user, a playbook, a widget, or a component. A playbook or component change shows the playbook or component name. View Run opens that run while run details are available. A workflow change includes Workflow executed, which opens the workflow run. A bulk update is labeled Modified using Bulk Update. Use the date filter to limit the list. The filter opens on Today. When Record Activity is enabled, a new, copied, or imported application includes two read-only fields, Creation source and Update source. They start in Hidden Fields. You can place them on the form or add them as report columns. Existing applications do not receive these fields until the application is copied or imported. A CSV export shows the display name for those fields when the export includes them. A CSV import does not keep the values in those columns. Turbine sets the source from the import. For more information, see [History](https://docs.swimlane.com/turbine-user-guide/history), [Import Data](https://docs.swimlane.com/turbine-user-guide/import-data), and [Export Record](https://docs.swimlane.com/turbine-user-guide/export-record). ### OpenSSL Upgrade and Cryptographic Compatibility This release upgrades OpenSSL to version 4.0 to maintain platform security and support. The updated version restricts certain weak cryptographic functions, which may affect existing Python scripts that rely on these functions. Customers are encouraged to review their Python scripts and ensure they use strong, supported cryptographic algorithms for hashing and encryption, such as SHA-256, to maintain compatibility and security. ## Addressed Issues The following issues are addressed in this release. ### Canvas - **Advanced Transform Looked Unsaved When You Only Opened It** — Fixed an issue where opening an existing Advanced Transform enabled Apply and Cancel asked you to discard changes even when you did not edit anything. Opening the editor no longer marks the transform as changed. Real edits still keep Apply available. - **Deleting an Orchestration Task Disabled the Playbook** — Fixed an issue where deleting an orchestration task (including leftover duplicate-button cleanup) silently turned the playbook off. Application buttons still looked correct, but the flow did not run until someone enabled the playbook again. Deleting the task no longer changes the enabled state. - **Upsert Did Not Clear a Field When You Sent an Empty Value** — Fixed an issue where Update/Create Record left the existing field value in place when you used Clear. The field was omitted from the update, so the record did not change. Providing an empty value now clears the field. - **Playbook Export Failed When a Transform Used a Wildcard Asset Path** — Fixed an issue where exporting a playbook failed if a Transform Data action used a JSONata wildcard such as `assets.*.Tenant_Details`. The export reported that it could not find an asset named `*`. Those expressions now export successfully. - **Hero AI Stayed Available After It Was Disabled** — Fixed an issue where Hero AI remained visible and usable after it was disabled, including after cache clear and first login, until you refreshed the playbook. Disabled Hero AI no longer appears for those users. - **Delete Connector Playbook Link Opened a Missing Page** — Fixed an issue where the playbook link on the connector delete confirmation opened a missing page. The link now opens the playbook. - **Retry Logic Labels Were Reversed** — Fixed an issue where retry configuration text said when an action would retry in one place and until in another, which did not match how retry works. The labels now describe retry until the condition is met. - **Deleting a List Item in an Asset Shifted Remaining Fields** — Fixed an issue where deleting an item from a list in the JSON builder (including nested lists or objects, and lists that contain password fields) renumbered or shifted the remaining items so saved values no longer matched the UI. Remaining items now keep the correct nested content after delete. - **Condition Builder Dropped the Second Variable After Reopen** — Fixed an issue where a numeric variable-to-variable comparison showed both variables after Apply, then hid the second variable when you reopened the condition and treated it as text. Both variables now stay visible when you reopen the condition. - **Attachment Fields Could Be Added to Conditions** — Fixed an issue where Condition Builder let you pick an attachment field even though attachments are not supported in conditions, which left a broken comparison. Condition Builder now states that attachment fields are not supported. - **Property References Corrupted Text in a String Input** — Fixed an issue where inserting a property reference into a string input scrambled the surrounding text. Property references now insert without changing the rest of the string. - **Transform Data Failed With a Null Object Error** — Fixed an issue where Transform Data failed with Cannot convert undefined or null to object when a JSONata expression used $sift() or referenced a missing property. Valid expressions complete, and invalid paths return a clear transform error. - **Record Event Trigger Properties Missing in Grouped Search Conditions** — Fixed an issue where Record Event Trigger properties were available in the main Search Records condition but missing after you added an AND or OR group. Only Metadata appeared, so you could not use trigger fields in grouped conditions. Those trigger properties are now available in grouped conditions as well. ### Dashboards and Reports - **Dashboard Metrics Changed After Switching Dashboards** — Fixed an issue where metric cards showed the correct values on first open, then showed wrong values after you opened another dashboard and returned. A full-page refresh restored the correct numbers. Switching dashboards no longer keeps the previous dashboard date filter, so unfiltered metrics match a full refresh. - **Dashboard First Load Ignored the Time Filter** — Fixed an issue where the first load of a dashboard showed all records and ignored the saved date and time filter (for example, Today so far). Re-applying the same filter corrected the view. Dashboards now apply the saved filter on first load. - **Scheduled Dashboard Emails Showed Incorrect Data** — Fixed an issue where a scheduled dashboard PDF or email showed the wrong dashboard, omitted filters, or mixed in another schedule when several jobs ran close together. Scheduled dashboard output now matches the intended dashboard and filters. - **Dashboard Preview and Download Ignored Dashboard Filters** — Fixed an issue where Preview, Download, Email, and Schedule used the report filters on the card instead of the dashboard filters you saved. Preview and download now match the dashboard you see, including dashboard-level and date-range filters. - **Dashboard Card Was Empty After Add Chart from a Report** — Fixed an issue where creating a dashboard card with Add Chart during report creation produced an empty card, including when the chart had no measures or dimensions. Those reports now appear as tables, and cards created from Add Chart show data. - **Global Export Omitted Dashboards** — Fixed an issue where Global Export left out dashboards that belonged to a workspace and were visible in the UI. Those dashboards are now included in the export package, and import keeps workspace and dashboard links in sync. - **Notification Usage Graph Showed Zero for Days With No Data** — Fixed an issue where the Notification Admin Panel usage graph treated missing days as 0, so hover could not distinguish a true zero from no data. Days with no data are omitted from the axis. Actual 0 values still display. - **Filtered Report Search Failed With a System Error** — Fixed an issue where some Condition Builder filters on values-list or user fields returned a system error instead of results. Filters such as Status does not equal Resolved, and sorts on Status or Current Owner, now complete. - **Filtered Report Showed Blank Status and Owner Columns** — Fixed an issue where a filtered application report showed empty Status and Current Owner columns even though the records had values. Those columns now show the expected labels and names. ### Records - **CSV and Report Export Wrote Incorrect Time Field Values** — Fixed an issue where a standalone Time field exported as a full timestamp such as 1970-01-01T21:43:00. When you download, schedule, or email a report, Time fields now show only the stored time. - **Record Row Opened an Invalid Page When Display Columns Were Empty** — Fixed an issue where clicking a Records Listing row that had a Tracking ID but no values in the visible columns opened an invalid record page. The row now opens the correct record. - **Required Fields Blocked Save When Workflow Hid or Made Them Optional** — Fixed an issue where the record form allowed save after a workflow hid a required field or made it optional, but the server rejected the save. Save validation now follows the same workflow rules as the form. - **Selected Radio Button Looked Cleared but Kept Its Value** — Fixed an issue where clicking an already selected radio button cleared the selection in the UI while the stored value stayed set. Save stayed unavailable, and dependent workflow still treated the old value as selected. Clicking the selected option now leaves it selected until you choose a different option. - **Saving a Record Reference Failed With an Error** — Fixed an issue where adding or saving a record reference failed with an error and the record did not update. Saving a reference now completes and keeps the linked record. ### Hero AI - **Hero AI Could Not Read the Open Record on Custom LLM Installs** — Fixed an issue where, on a custom LLM On-Prem install, Hero AI reported that no tools were available to read the open record. The services Hero AI uses to read that record now start with the install, so Companion can read the open record. ### Library - **Application Import Unlinked Playbooks That Were Not Selected** — Fixed an issue where importing or deploying only an application from the Library overwrote that application's playbook triggers even when those playbooks were not selected. The import reported missing playbook dependencies, and the playbooks were unlinked from the application. Importing only the application now leaves existing playbook links in place when those playbooks are not selected for overwrite. ### Classic Playbooks - **Classic Playbook Publish Stopped on a Blank Step** — Fixed an issue where Next after Content Information opened a blank review step if you continued before the playbook finished validating. Next now stays unavailable until the check finishes, then opens the review step so you can publish.