Plugin(s) detected. Plugins are not provided by SonarSource…

Error message

Plugin(s) detected. Plugins are not provided by SonarSource and are therefore installed at your own risk. A SonarQube administrator needs to acknowledge this risk once logged in.

What it means

The second line of the plugin-risk banner emitted by PluginConsentVerifier.addWarningInSonarDotLog at startup (called from start). It explicitly states that detected plugins are not provided by SonarSource and require an administrator to acknowledge the installation risk once logged in. Purely informational; server startup is unaffected.

Solutions

Have an administrator log in and accept the plugin risk acknowledgment banner in the web UI
Remove unwanted plugins from extensions/plugins and restart if consent is not desired
In automated deployments, perform the acknowledgment once as part of provisioning

Defensive patterns

Strategy: validation

Validate before calling

boolean consentRecorded = /* check admin acknowledgment flag via UI/API */;
if (hasPluginsInstalled() && !consentRecorded) {
  log.info("Administrator must acknowledge plugin risk after first login");
}

Prevention

Perform the one-time administrator acknowledgment immediately after plugin installation
Strip unused plugins from golden/CI images so the banner never appears
Document the consent step in your SonarQube provisioning automation

When it happens

Trigger: Server startup with plugins installed and the consent flag not yet set; LOGGER.warn(msg) executes in addWarningInSonarDotLog, invoked by start().

Common situations: Fresh SonarQube installs with plugins pre-copied; CI/container images bundling plugins; environments where administrators never visit the consent screen.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/8365bfc64de91156. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-api/src/main/java/org/sonar/server/plugins/PluginConsentVerifier.java:80

        session.commit();
      }
    }
  }

  private static PropertyDto defaultPluginRiskConsentProperty() {
    PropertyDto property = new PropertyDto();
    property.setKey(PLUGINS_RISK_CONSENT);
    property.setValue(NOT_ACCEPTED.name());
    return property;
  }

  private static void addWarningInSonarDotLog() {
    String highlighter = "####################################################################################################################";
    String msg = "Plugin(s) detected. Plugins are not provided by SonarSource and are therefore installed at your own risk."
        + " A SonarQube administrator needs to acknowledge this risk once logged in.";

    LOGGER.warn(highlighter);
    LOGGER.warn(msg);
    LOGGER.warn(highlighter);
  }

  @Override
  public void stop() {
    // Nothing to do
  }

}

View on GitHub (pinned to 184c821202)