diff --git a/nova/api/metadata/password.py b/nova/api/metadata/password.py
index f180a41225c8..96531e43a7c0 100644
--- a/nova/api/metadata/password.py
+++ b/nova/api/metadata/password.py
@@ -18,6 +18,7 @@ from six.moves import range
 from webob import exc
 
 from nova import context
+from nova import exception
 from nova.i18n import _
 from nova import objects
 from nova import utils
@@ -69,7 +70,10 @@ def handle_password(req, meta_data):
 
         im = objects.InstanceMapping.get_by_instance_uuid(ctxt, meta_data.uuid)
         with context.target_cell(ctxt, im.cell_mapping) as cctxt:
-            instance = objects.Instance.get_by_uuid(cctxt, meta_data.uuid)
+            try:
+                instance = objects.Instance.get_by_uuid(cctxt, meta_data.uuid)
+            except exception.InstanceNotFound as e:
+                raise exc.HTTPBadRequest(explanation=e.format_message())
         instance.system_metadata.update(convert_password(ctxt, req.body))
         instance.save()
     else:
diff --git a/nova/tests/unit/test_metadata.py b/nova/tests/unit/test_metadata.py
index f90aedec88b3..ca847eced67f 100644
--- a/nova/tests/unit/test_metadata.py
+++ b/nova/tests/unit/test_metadata.py
@@ -1635,6 +1635,20 @@ class MetadataPasswordTestCase(test.TestCase):
         result = password.handle_password(request, self.mdinst)
         self.assertEqual(result, 'foo')
 
+    @mock.patch.object(objects.InstanceMapping, 'get_by_instance_uuid',
+                       return_value=objects.InstanceMapping(cell_mapping=None))
+    @mock.patch.object(objects.Instance, 'get_by_uuid')
+    def test_set_password_instance_not_found(self, get_by_uuid, get_mapping):
+        """Tests that a 400 is returned if the instance can not be found."""
+        get_by_uuid.side_effect = exception.InstanceNotFound(
+            instance_id=self.instance.uuid)
+        request = webob.Request.blank('')
+        request.method = 'POST'
+        request.val = b'foo'
+        request.content_length = len(request.body)
+        self.assertRaises(webob.exc.HTTPBadRequest, password.handle_password,
+                          request, self.mdinst)
+
     def test_bad_method(self):
         request = webob.Request.blank('')
         request.method = 'PUT'