Just to point here, probably will help someone else.
The vulnerability was not observed in any of the RASA service. I realized that the port was 8080, and I had configured a different service on that port.
So just to clear, if you find such thing, probably its something else.