diff --git a/.changelog/11781.txt b/.changelog/11781.txt
new file mode 100644
index 000000000..754d9e01b
--- /dev/null
+++ b/.changelog/11781.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+cli: when creating a private key, save the file with mode 0600 so that only the user has read permission.
+```