How can I get the underlying JDBC connection which the CMP bean is using?

Technically speaking you can't. But you can access a JDBC connection within the same transaction from a CMP bean using the following XML deployment descriptor :

<enterprise-beans>
   <entity>
      <resource-ref>
             <description>Datasource for the myDB database</description>
             <res-ref-name>jdbc/myDB</res-ref-name>
             <res-type>java.sql.Datasource</res-type>
             <res-auth>Container</res-auth>
      </resource-ref>   
         ...
    </entity>
  ....
</enterprise-beans>