Three patch releases have shipped on each line since the last advisory (5.6.12 / 5.7.5). Affected versions: all 5.6.x releases prior to 5.6.15, and all 5.7.x releases prior to 5.7.8. We recommend upgrading to 5.6.15 or 5.7.8. Full changelogs: 5.6.x / 5.7.x.
Mango 5.6.x
5.6.13 (Sep 28, 2026)
Security: BouncyCastle upgraded to 1.86, resolving CVE-2026-8763 and CVE-2026-13506 (neither exploitable in Mango's configuration). Apache SSHD, used by Cloud Connect, upgraded to 2.19.0, resolving CVE-2026-56624.
Security: FreeMarker upgraded to 2.3.35, hardening template loading against directory traversal, XML-escaping xmlns, and restricting a template's ability to list Java system properties.
Breaking change: Mango may now reject private keys or certificates with unusually expensive key-derivation parameters or malformed subject names at startup, due to stricter BouncyCastle limits on untrusted input.
Fixed an event-acknowledgement rollback bug, and a failing event handler blocking every handler after it, on the Events page.
5.6.14 (Oct 5, 2026)
Security: Fixed CVE-2026-84939, a path traversal via a malformed locale identifier, by upgrading the bundled Moment.js UI dependency to 2.31.0.
Security: Jackson (jackson-databind) upgraded to 2.21.7, fixing two denial-of-service CVEs (2026-91777, 2026-91776). Mango doesn't use the feature behind the first; the second can only be triggered by the remote source a Persistent TCP publisher connects to.
Fixed the Cloud Connect proxy filter intercepting requests for any hostname under its configured proxy domain even while the proxy itself was disabled, a regression present since 5.6.0. The filter now only registers when the proxy is explicitly enabled.
Fixed several data sources and publishers (BACnet COV, VMStat, SNMP traps, MQTT Sparkplug, Modbus IP publisher) running on background threads without a security context, which silently dropped event detectors, meta point updates, and reconnect handling.
5.6.15 (Oct 14, 2026, latest)
Security: Fixed CVE-2026-106451, a local privilege escalation in lz4-java. On a server where Mango connects to ClickHouse, another local user could replace the native library Mango extracts to its temp directory and run code inside Mango. If you can't upgrade immediately, set paths.temp in mango.properties to a directory only the Mango user can write to.
A BACnet device writing to a published object's non-presentValue properties (e.g. description) no longer sets the corresponding Mango point value; only writes to presentValue do.
Fixed events raised by non-superadmin users, or by a data source/publisher with no signed-in user, failing to notify configured event handlers and alarm recipients.
Fixed acknowledging an event as a non-superadmin user stopping its handlers from firing when the event returns to normal.
Mango 5.7.x
5.7.6 (Sep 23, 2026)
Security: Same BouncyCastle and Apache SSHD fixes as 5.6.13 above.
Security: Watch-list maintenance events previously evaluated the watch list as superadmin, regardless of who configured the event, so it could suppress alarms on points the configuring user couldn't even read. A new "Roles used to resolve watch list points" setting scopes this correctly. Existing events are migrated to superadmin to preserve current behavior; review them if that's broader than intended. (5.7.x only, not backported to 5.6.x)
New OAuth 2.0 / OIDC extraClaims feature: fetch additional claims (groups, roles) from an HTTP endpoint for identity providers that can't include them directly in the token. (5.7.x only)
gRPC connections now send keepalive pings, detecting a vanished peer in about 90 seconds instead of stalling indefinitely. (5.7.x only)
Breaking change: Same stricter BouncyCastle key/certificate validation as 5.6.13.
5.7.7 (Oct 5, 2026)
Security: Same FreeMarker hardening as 5.6.13 (lands one release later on this line).
Security: Same Moment.js (CVE-2026-84939) and Jackson (CVE-2026-91777, CVE-2026-91776) fixes as 5.6.14.
Same Cloud Connect proxy filter fix and background-thread security context fix as 5.6.14.
5.7.8 (Oct 14, 2026, latest)
Security: Same lz4-java fix as 5.6.15 (CVE-2026-106451). Also upgrades Spring Framework to 7.0.9, fixing CVE-2026-47884 and CVE-2026-47890 - Mango isn't affected by either, since it doesn't use XSLT views or render view fragments as server-sent events. (Spring upgrade is 5.7.x only)
Fixed authentication tokens being rejected once a user's password expired, which broke token-based integrations (e.g. polling engines) with no visible error. Token validity no longer depends on password age. (5.7.x only)
Same BACnet publisher property-write fix and non-superadmin event-handling fixes as 5.6.15.
As always, back up your database and configuration before upgrading, and test in a non-production environment first.
