The REST API plugin feature is not granular enough, having an "all included" access could be posing a bigger risk than needed. Prefer using your own proxy on top of the Airflow API and disable this feature.
Using the RESP API plugin can pose a security risk
Disable this plugin / feature see more here
Updated 2 months ago