diff --git a/src/java/org/apache/cassandra/utils/JMXServerUtils.java b/src/java/org/apache/cassandra/utils/JMXServerUtils.java
index 3f26d59e6e..78c8ced8d2 100644
--- a/src/java/org/apache/cassandra/utils/JMXServerUtils.java
+++ b/src/java/org/apache/cassandra/utils/JMXServerUtils.java
@@ -104,6 +104,8 @@ public class JMXServerUtils
         // via a JAAS configuration entry, or one which delegates to the standard file based authenticator.
         // Authn is disabled if com.sun.management.jmxremote.authenticate=false
         env.putAll(configureJmxAuthentication());
+        // Secure credential passing to avoid deserialization attacks
+        env.putAll(configureSecureCredentials());
 
         // Configure authz - if a custom proxy class is specified an instance will be returned.
         // If not, but a location for the standard access file is set in system properties, the
@@ -154,6 +156,13 @@ public class JMXServerUtils
         return createJMXServer(port, null, local);
     }
 
+    private static Map<String, Object> configureSecureCredentials()
+    {
+        Map<String, Object> env = new HashMap<>();
+        env.put("jmx.remote.rmi.server.credentials.filter.pattern", String.class.getName() + ";!*");
+        return env;
+    }
+
     private static Map<String, Object> configureJmxAuthentication()
     {
         Map<String, Object> env = new HashMap<>();
@@ -187,8 +196,6 @@ public class JMXServerUtils
 
             env.put(JMXConnectorServer.AUTHENTICATOR, new JMXPluggableAuthenticatorWrapper(env));
         }
-        env.put("jmx.remote.rmi.server.credential.types",
-            new String[] { String[].class.getName(), String.class.getName() });
         return env;
     }