Advisory patched but never published — what options does a reporter have?

[BrandonChoKR]

I reported a pre-authentication DoS in openclaw (npm) on 2026-07-28 through
GitHub's private vulnerability reporting: GHSA-4r25-35qc-fr6j. The maintainers
accepted it, merged a fix on 2026-08-01 (PR #115038, commit beab295), released
it in 2026.7.2-beta.7, and accepted my reporter credit.

The advisory has been in draft ever since — 35 days. I asked about CVE assignment
twice in the thread and mentioned an owner directly, since publish and Request
CVE require owner permissions. No response to either.

Two things make me think this isn't specific to my report:

1. The repository has published no security advisories at all since 2026-06-30.
   Before that, publishing happened in monthly batches, each by a different
   individual.
2. The advisories it has published carry no CVE ID. For example
   GHSA-jhfx-v2j8-x3m6 (CVSS 7.6, High, published 2026-06-30) lists
   "No known CVE." Requesting CVE IDs doesn't appear to be part of this
   project's workflow.

Meanwhile latest (2026.7.1-2) and extended-stable (2026.6.34) still ship the
vulnerable code with no patched release on either channel, and the fix commit's
regression test spells out the reproduction publicly. So the vulnerability is
publicly known while affected users have no notice.

I've published a write-up so users have actionable information: [https://brandonlog.tistory.com/159]

My questions:

• Is there anything a reporter can do to get a draft advisory published when the
  repository owners are unresponsive?
• Given that GitHub is the CNA with scope over this repository but no assignment
  has occurred, is MITRE CNA-LR the correct path for the CVE ID? I'd rather not
  route around GitHub's scope if there's a better option.

Happy to provide any details that would help.

[taladrane]

hi @BrandonChoKR and thank you for your questions! unfortunately there isn't anything you can do to force advisory publication when repo owner are unresponsive. GitHub did not receive a CVE request for this GHSA from the maintainers, so you can reach out to another CNA like the MITRE CNA-LR for a CVE ID in this case - and include that we've confirmed we don't have an outstanding/duplicate request to avoid scope conflict

we appreciate you taking these extra steps in the interest of security!