server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
No related bugs.