OpenAPI or Swagger document is public
/openapi.json or /swagger.json is reachable and describes an API.
Why it matters
A public schema lists paths and parameters. That is intentional for a public API and extra detail for a private one.
What to do
Restrict the document to operators unless you mean for it to be public.
Reference
Server and framework disclosure headers reveal implementation details useful to attackers.