diff --git a/src/test/app/Credentials_test.cpp b/src/test/app/Credentials_test.cpp
index e5d90d976..db87f1825 100644
--- a/src/test/app/Credentials_test.cpp
+++ b/src/test/app/Credentials_test.cpp
@@ -1058,6 +1058,38 @@ struct Credentials_test : public beast::unit_test::suite
         }
     }
 
+    void
+    testFlags(FeatureBitset features)
+    {
+        using namespace test::jtx;
+
+        testcase("Test flags");
+
+        const char credType[] = "abcde";
+        Account const issuer{"issuer"};
+        Account const subject{"subject"};
+
+        {
+            using namespace jtx;
+            Env env{*this, features};
+
+            env.fund(XRP(5000), subject, issuer);
+            env.close();
+
+            {
+                env(credentials::create(subject, issuer, credType),
+                    txflags(tfTransferable),
+                    ter(temINVALID_FLAG));
+                env(credentials::accept(subject, issuer, credType),
+                    txflags(tfSellNFToken),
+                    ter(temINVALID_FLAG));
+                env(credentials::deleteCred(subject, subject, issuer, credType),
+                    txflags(tfPassive),
+                    ter(temINVALID_FLAG));
+            }
+        }
+    }
+
     void
     run() override
     {
@@ -1069,6 +1101,7 @@ struct Credentials_test : public beast::unit_test::suite
         testAcceptFailed(all);
         testDeleteFailed(all);
         testFeatureFailed(all - featureCredentials);
+        testFlags(all);
         testRPC();
     }
 };
diff --git a/src/xrpld/app/tx/detail/Credentials.cpp b/src/xrpld/app/tx/detail/Credentials.cpp
index 4da875f8d..5c0f4452e 100644
--- a/src/xrpld/app/tx/detail/Credentials.cpp
+++ b/src/xrpld/app/tx/detail/Credentials.cpp
@@ -65,6 +65,12 @@ CredentialCreate::preflight(PreflightContext const& ctx)
     auto const& tx = ctx.tx;
     auto& j = ctx.j;
 
+    if (tx.getFlags() & tfUniversalMask)
+    {
+        JLOG(ctx.j.debug()) << "CredentialCreate: invalid flags.";
+        return temINVALID_FLAG;
+    }
+
     if (!tx[sfSubject])
     {
         JLOG(j.trace()) << "Malformed transaction: Invalid Subject";
@@ -209,6 +215,12 @@ CredentialDelete::preflight(PreflightContext const& ctx)
     if (auto const ret = preflight1(ctx); !isTesSuccess(ret))
         return ret;
 
+    if (ctx.tx.getFlags() & tfUniversalMask)
+    {
+        JLOG(ctx.j.debug()) << "CredentialDelete: invalid flags.";
+        return temINVALID_FLAG;
+    }
+
     auto const subject = ctx.tx[~sfSubject];
     auto const issuer = ctx.tx[~sfIssuer];
 
@@ -289,6 +301,12 @@ CredentialAccept::preflight(PreflightContext const& ctx)
     if (auto const ret = preflight1(ctx); !isTesSuccess(ret))
         return ret;
 
+    if (ctx.tx.getFlags() & tfUniversalMask)
+    {
+        JLOG(ctx.j.debug()) << "CredentialAccept: invalid flags.";
+        return temINVALID_FLAG;
+    }
+
     if (!ctx.tx[sfIssuer])
     {
         JLOG(ctx.j.trace()) << "Malformed transaction: Issuer field zeroed.";