Werk #19088: Agent Bakery signing key expiry notification now uses BCC for recipients

Component

Agent bakery

Title

Agent Bakery signing key expiry notification now uses BCC for recipients

Date

Feb 26, 2026

Level

Trivial Change

Class

Bug Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

2.6.0b1 Not yet released	Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.5.0b1 Not yet released	Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.4.0p23 Not yet released	Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.3.0p43	Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)

When Checkmk sends notification emails about expiring Agent Bakery signing keys, all recipient addresses were previously listed in the To header. In multi-tenant environments this caused all recipients, including customers from different organizations, to see each other's email addresses.

Recipients are now placed in the Bcc header instead, so that individual addresses remain hidden from all other recipients.

To the list of all Werks