CVE-2016-4474

high

Published 2016-06-30 · Modified 2026-05-06

CVSS v3

8.8

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2

3.3

VIR risk

8.8

Description

The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka overcloud-full) use a default root password of ROOTPW, which allows attackers to gain access via unspecified vectors.

Predictions

Exploit likelihood

82%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://rhn.redhat.com/errata/RHSA-2016-1223.html

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://access.redhat.com/security/vulnerabilities/2359821

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — http://rhn.redhat.com/errata/RHSA-2016-1222.html

Application impact

Vendor	Product	Versions	Fixed
redhat	openstack	`7.0`
redhat	openstack	`8`

References

CWEs

CWE-200 CWE-254

Verify integrity in audit chain (admin only). AS-IS.