I reported a pre-authentication DoS in openclaw (npm) on 2026-07-28 through
GitHub's private vulnerability reporting: GHSA-4r25-35qc-fr6j. The maintainers
accepted it, merged a fix on 2026-08-01 (PR #115038, commit beab295), released
it in 2026.7.2-beta.7, and accepted my reporter credit.

The advisory has been in draft ever since — 35 days. I asked about CVE assignment
twice in the thread and mentioned an owner directly, since publish and Request
CVE require owner permissions. No response to either.

Two things make me think this isn't specific to my report:

1. The repository has published no security advisories at all since 2026-06-30.
   Before that, publishing happened in monthly batches, each by a different
   individual.
2. The advisories it has published carry no CVE ID. For example
   GHSA-jhfx-v2j8-x3m6 (CVSS 7.6, High, published 2026-06-30) lists
   "No known CVE." Requesting CVE IDs doesn't appear to be part of this
   project's workflow.

Meanwhile latest (2026.7.1-2) and extended-stable (2026.6.34) still ship the
vulnerable code with no patched release on either channel, and the fix commit's
regression test spells out the reproduction publicly. So the vulnerability is
publicly known while affected users have no notice.

I've published a write-up so users have actionable information: [https://brandonlog.tistory.com/159]

My questions:

• Is there anything a reporter can do to get a draft advisory published when the
  repository owners are unresponsive?
• Given that GitHub is the CNA with scope over this repository but no assignment
  has occurred, is MITRE CNA-LR the correct path for the CVE ID? I'd rather not
  route around GitHub's scope if there's a better option.

Happy to provide any details that would help.