I'm also guessing it's a path issue. rpm has to be installed as a precursor to the base system being installed. If you can login, you've got rpm.

Is is usual for root to have a very limited path. This is by design, if root always has to explicitly type paths, there is far less chance of a system binary being trojaned through a path attack.