diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialProviderFactory.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialProviderFactory.java
index 36b4ecb0440..3bb4f6d17bf 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialProviderFactory.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/alias/CredentialProviderFactory.java
@@ -54,12 +54,16 @@ public abstract class CredentialProviderFactory {
       try {
         URI uri = new URI(path);
         boolean found = false;
-        for(CredentialProviderFactory factory: serviceLoader) {
-          CredentialProvider kp = factory.createProvider(uri, conf);
-          if (kp != null) {
-            result.add(kp);
-            found = true;
-            break;
+        // Iterate serviceLoader in a synchronized block since
+        // serviceLoader iterator is not thread-safe.
+        synchronized (serviceLoader) {
+          for (CredentialProviderFactory factory : serviceLoader) {
+            CredentialProvider kp = factory.createProvider(uri, conf);
+            if (kp != null) {
+              result.add(kp);
+              found = true;
+              break;
+            }
           }
         }
         if (!found) {