H2's local file-based database is used to store ODL credentials.  Since the file is only accessible locally, default credentials were originally utilized (predates my involvement with the project).  This isn't super alarming, as manipulation of these values requires access to the machine in the first place.  However, the credentials should be configurable for added security.