Have you tried to access other endpoints?
I think that protection is enabled for actuator endpoints that make the full content unavailable, to access the full content, which you must disable for security, or to use its basic credentials for authentication.
To disable security, add the following to your application.yml -
management:
security:
enabled: false