It was found that newly generated CA keys by running pulp-gen-ca-certificate (which is run by spec file when pulp is installed) script are insufficiently protected against reading by other users for the time the script runs.
Vulnerable code:
https://github.com/pulp/pulp/blob/2.8.0/server/bin/pulp-gen-ca-certificate