diff --git a/nova/api/openstack/servers.py b/nova/api/openstack/servers.py
index 553357404062..fa499b192228 100644
--- a/nova/api/openstack/servers.py
+++ b/nova/api/openstack/servers.py
@@ -604,8 +604,10 @@ class ControllerV10(Controller):
             LOG.debug(msg)
             raise exc.HTTPBadRequest(explanation=msg)
 
+        password = utils.generate_password(16)
+
         try:
-            self.compute_api.rebuild(context, instance_id, image_id)
+            self.compute_api.rebuild(context, instance_id, image_id, password)
         except exception.BuildInProgress:
             msg = _("Instance %s is currently being rebuilt.") % instance_id
             LOG.debug(msg)
@@ -741,15 +743,19 @@ class ControllerV11(Controller):
             self._validate_metadata(metadata)
         self._decode_personalities(personalities)
 
+        password = info["rebuild"].get("adminPass",
+                                       utils.generate_password(16))
+
         try:
-            self.compute_api.rebuild(context, instance_id, image_href, name,
-                                     metadata, personalities)
+            self.compute_api.rebuild(context, instance_id, image_href,
+                                     password, name=name, metadata=metadata,
+                                     files_to_inject=personalities)
         except exception.BuildInProgress:
             msg = _("Instance %s is currently being rebuilt.") % instance_id
             LOG.debug(msg)
             raise exc.HTTPConflict(explanation=msg)
 
-        return webob.Response(status_int=202)
+        return webob.Response(status_int=202, headers={'x-nova-password':password})
 
     @common.check_snapshots_enabled
     def _action_create_image(self, input_dict, req, instance_id):
diff --git a/nova/compute/api.py b/nova/compute/api.py
index 69f76bf4016c..0ac38a428be1 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -1023,8 +1023,8 @@ class API(base.Base):
         self._cast_compute_message('reboot_instance', context, instance_id)
 
     @scheduler_api.reroute_compute("rebuild")
-    def rebuild(self, context, instance_id, image_href, name=None,
-            metadata=None, files_to_inject=None):
+    def rebuild(self, context, instance_id, image_href, admin_password,
+                name=None, metadata=None, files_to_inject=None):
         """Rebuild the given instance with the provided metadata."""
         instance = db.api.instance_get(context, instance_id)
 
@@ -1044,6 +1044,7 @@ class API(base.Base):
         self.db.instance_update(context, instance_id, values)
 
         rebuild_params = {
+            "new_pass": admin_password,
             "image_ref": image_href,
             "injected_files": files_to_inject,
         }
@@ -1052,6 +1053,7 @@ class API(base.Base):
                                    context,
                                    instance_id,
                                    params=rebuild_params)
+        return rebuild_params
 
     @scheduler_api.reroute_compute("revert_resize")
     def revert_resize(self, context, instance_id):
diff --git a/nova/compute/manager.py b/nova/compute/manager.py
index c207eccbb7d0..40cd09044320 100644
--- a/nova/compute/manager.py
+++ b/nova/compute/manager.py
@@ -527,6 +527,7 @@ class ComputeManager(manager.SchedulerDependentManager):
         :param context: `nova.RequestContext` object
         :param instance_id: Instance identifier (integer)
         :param image_ref: Image identifier (href or integer)
+        :param new_pass: password to set on rebuilt instance
         """
         context = context.elevated()
 
@@ -544,6 +545,11 @@ class ComputeManager(manager.SchedulerDependentManager):
         network_info = self.network_api.get_instance_nw_info(context,
                                                               instance_ref)
         bd_mapping = self._setup_block_device_mapping(context, instance_id)
+
+        # pull in new password here since the original password isn't in the db
+        new_pass = kwargs.get('new_pass')
+        instance_ref.admin_pass = new_pass
+
         self.driver.spawn(context, instance_ref, network_info, bd_mapping)
 
         self._update_image_ref(context, instance_id, image_ref)