SonarSource/sonarqube · warning

Default Administrator credentials are still being used…

Error message

Default Administrator credentials are still being used. Make sure to change the password or deactivate the account.

What it means

This is the human-readable security message of the same banner from DefaultAdminCredentialsVerifierImpl.addWarningInSonarDotLog: default administrator credentials are still in use and must be changed or the account deactivated.

Solutions

1. Change the admin password to a strong value via the UI or the web API (api/users/change_password).
2. Deactivate the built-in admin account if a dedicated administrator account exists.
3. Confirm the warning is gone on next startup/re-check.

// check whether default creds authenticate; if they do, rotate immediately
status=$(curl -s -u admin:admin -o /dev/null -w '%{http_code}' $SONAR_URL/api/authentication/validate)
[ "$status" = "401" ] || echo "ALERT: default admin credentials active"

When it happens

Trigger: runAtStart() -> isDefaultCredentialUser() successfully authenticates the default admin user with password "admin" using localAuthentication.authenticate(dbSession, user, "admin", BASIC), triggering the warning message.

Common situations: Unchanged default password after first install; scripted deployments that never set SONAR_WEB_SYSTEMPASSCODE or rotate the admin password.

Related errors

• ############################################################…
• Authentication is not enforced, and permissions assigned to…
• Authentication is required
• Email ' ' is already used
• Failed to authenticate with login

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/0efdee1c5aba0cda. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/DefaultAdminCredentialsVerifierImpl.java:85

      UserDto admin = getAdminUser(session);
      if (admin == null) {
        return false;
      } else {
        return isDefaultCredentialUser(session, admin);
      }
    }
  }

  private UserDto getAdminUser(DbSession session) {
    return dbClient.userDao().selectActiveUserByLogin(session, "admin");
  }

  private static void addWarningInSonarDotLog() {
    String highlighter = "####################################################################################################################";
    String msg = "Default Administrator credentials are still being used. Make sure to change the password or deactivate the account.";

    LOGGER.warn(highlighter);
    LOGGER.warn(msg);
    LOGGER.warn(highlighter);
  }

  private boolean isDefaultCredentialUser(DbSession dbSession, UserDto user) {
    try {
      localAuthentication.authenticate(dbSession, user, "admin", AuthenticationEvent.Method.BASIC);
      return true;
    } catch (AuthenticationException ex) {
      return false;
    }
  }

  private void sendEmailToAdmins(DbSession session) {
    if (dbClient.internalPropertiesDao().selectByKey(session, DEFAULT_ADMIN_CREDENTIAL_USAGE_EMAIL)
      .map(Boolean::parseBoolean)
      .orElse(false)) {
      return;
    }

View on GitHub (pinned to 184c821202)