CVE-2016-4474

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-30 · updated 2026-06-17
Weakness: CWE-200

Description

The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka overcloud-full) use a default root password of ROOTPW, which allows attackers to gain access via unspecified vectors.

Affected products

OpenStack: 7.0, 8

References

http://rhn.redhat.com/errata/RHSA-2016-1222.html
https://access.redhat.com/security/vulnerabilities/2359821
https://rhn.redhat.com/errata/RHSA-2016-1223.html
http://rhn.redhat.com/errata/RHSA-2016-1222.html
https://access.redhat.com/security/vulnerabilities/2359821
https://rhn.redhat.com/errata/RHSA-2016-1223.html

Get alerted when CVE-2016-4474 or the next vulnerability affects your stack