server/bin/pulp-gen-ca-certificate in Pulp prior to 2.8.2 allows local users to read the generated private key.
fedoraproject fedora 24
pulpproject pulp