Security Rating is E despite 0 Open Security Issues

Hello.

We would like the Security Rating to be A for our project.
However, the current Security Rating is E.

Quality Gate condition:

  • Conditions on Overall Code
  • Security Rating is worse than A

At the same time, the project dashboard shows:

  • Security: 0 Open Issues

Despite having zero open security issues, the Security Rating is displayed as E.

Versions

  • SonarQube Enterprise Edition: 2026.1.2
  • Scanner: scanner-cli:prod-8.0.1
  • Plugins/Extensions: No custom plugins

Deployment Method

SonarQube is deployed using:

  • Podman

Database:

  • PostgreSQL 17.6

What We Are Trying to Achieve

We want the Security Rating on Overall Code to be A so that the Quality Gate passes successfully.

What We Have Tried So Far

  • Checked Security Issues count
  • Re-ran project analysis
  • Verified Background Tasks completed successfully

Questions

Could you please help clarify:

  1. Under what conditions can the Security Rating become E while Security Issues are 0?
  2. Whether there are any known issues or fixes related to this behavior?

Thank you for your support.

Hi,

Off-hand, this looks like a bad Elasticsearch index. Can you check the Issues page, and make sure that no vulnerabilities show up there? If so, it’s time to force an ElasticSearch reindex.

 
HTH,
Ann