n8n post-mortem

On 15 August 2026, after the owner account of a self-hosted n8n was rebuilt, the login worked and then bounced straight back to the login screen. The server logs showed no authentication error. The API and all 24 workflows kept running, so no data was lost, but the editor was out of reach.

Authentication never failed. n8n finds a user's personal project through one column, and that column still pointed to the deleted user. The browser console showed a 404 on the personal-project endpoint, an error the server never logged.

Nothing was changed on a guess. Read-only database queries, the logs set against the exact login times and curl requests changed one variable at a time confirmed the cause first. Then a script scanned every table for the deleted user's id and found 726 stale references, where the manual repair had found one.

Fixing them also restored the API keys of an external integration and several internal workflows, which had been failing silently for hours. From lockout to fix took about 1 hour 20 minutes.

Removing the whole user row, an early step, is what caused the damage; clearing three 2FA fields would have been enough. Since then I correct data and avoid deleting it. An error message from the second reset had described the cause in plain text, so I now read error messages as data. And when the server looks healthy, I check the browser early.