What's the soteri-security User?

When Security for Confluence Data Center is installed, it creates a new user with the username soteri-security. This user is automatically added to the confluence-administrators group so that it can access all Confluence content when scanning.

Removing or otherwise limiting the access of this user will cause the plugin to malfunction.

See Confluence Admin Permissions Levels Explained for more information.

For soteri-security there is no password, it's not stored anywhere, and it's impossible to log in as this user, so no external users can log in and gain unauthorized access. Security for Confluence is not vulnerable to issues like CVE-2022-26138.