SPR v1.2.0 adds stronger isolation and network controls to SPR's plugin system. SPR can run plugins with krun, authenticate their UIs, and apply network policy to each plugin. Plugins can also request limited API access and add outbound routes to the network topology.
Networking plugins handle untrusted traffic and often need elevated permissions. These boundaries let them extend SPR without sharing the router's level of access.
Reproducible containers started shipping with v1.1.6.
SPR has defended against these attacks since 2022. We identified how weak network isolation was and built SPR from the ground up to solve it. Per-device VLANs, per-device GTKs, per-device passwords, and coordinated Layer 2/3 firewall policy have shipped as defaults from day one. Every mitigation the paper recommends, SPR already does out of the box.
Now a top-tier academic paper from NDSS 2026 (PDF) confirms what we've been saying: Wi-Fi client isolation is fundamentally broken. The researchers tested every major router vendor and found that every single one was vulnerable to at least one of their attacks. Even more critically, the attacks break through guest network boundaries into main networks, meaning the "guest Wi-Fi" that most routers advertise as a security feature provides no real isolation.
The MACStealer attack (CVE-2022-47522) published by Mathy Vanhoef demonstrates how attackers can bypass WiFi client isolation by spoofing a victim's MAC address. By doing so, they can intercept queued frames or communicate across security boundaries on the same access point.
Guest networks, multi-PSK setups, WPA-EAP environments, and hotspots are all affected.