The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Source: NVD ↗ · CISA KEV Catalog ↗